wazuh-modulesd:database: WARNING: Removing dangling WDB DB file: 'queue/db/041.db'

[Andrehens Chicfici]

Hey,

since about two weeks I can find the followong error message in my ossec.log.

"wazuh-modulesd:database: WARNING: Removing dangling WDB DB file: 'queue/db/041.db'" 

It's always file /var/ossec/queue/db/041.db. What makey this .db file dangling? 

Cheers

chic

[leon....@wazuh.com]

Hello Chic,

Wazuh keeps one small SQLite database per agent under /var/ossec/queue/db/, named after the agent ID (so 041.db belongs to agent ID 041). If a .db file exists but Wazuh no longer has a current agent with that ID (for example the agent was deleted, re-enrolled under a new ID, moved to another node in a cluster, etc.), the database file is considered dangling and the wazuh-modulesd:database module deletes it at startup/scan time, hence the warning.

Based on your comments, I understand that this has been ongoing for several weeks, so I assume that the agent looses connectivity with the manager for some reason and tries to re-enroll, making the manager think that the agent has been removed or enrolled with another ID.

Reference: https://documentation.wazuh.com/current/user-manual/reference/daemons/wazuh-db.html

I hope this explanation was clear. Let me know if you have more questions or concerns.

Regards,