Not seeing new Solved and Active events in Vulnerability Management
Bob Barrett
One of my Wazuh servers, Solved and Active events no longer appear in Data vulnerability status. I do see that Wazuh is detecting vulnerabilities, but there are no more data.vulnerability.status events. When using Vulnerability Detection, I see current detections in the Inventory view, but nothing in the Events view. Problem started about 2-3 months ago. I tried clearing the vulnerability cache but that did not help.
hasitha.u...@wazuh.com
The Vulnerability Detection module generates alerts upon the detection of new vulnerabilities or the resolution of existing vulnerabilities, such as through package updates, removals, or system upgrades. However, while these conditions are necessary, they are not always enough for alert generation, which depends on specific detection scenarios.
Operating System Alerts Operating system alerts are not generated during the initial inventory scan. Upon the first sync of a Wazuh agent with the Wazuh manager, changes to the operating system version or recent patches are not seen as new events. Alerts are triggered only in later scans upon detection of such changes.
Package Alerts Alerts about package changes are generated only when a vulnerability is added to or removed from the inventory due to package installation or removal. This requires that the event be captured during a scheduled Syscollector scan. No alerts will be generated if changes occur while the Wazuh agent is stopped or if they are detected right after an agent restart.
Additional Considerations
- In a clustered environment, when a Wazuh agent reconnects to a different manager node, it syncs its inventory with the new node. However, this initial sync does not generate alerts, even if changes exist.
- Upon updating vulnerability content (such as CVE definitions, translations, or mapping rules) on the server, all agents are rechecked to keep results accurate. No alerts are generated during this initial recheck triggered by content updates.
Let me know while accessing to the Vulnerability detection -> Events tab, showing any error or any data.
First, make sure that Syscollector scanning is running properly on the endpoint. On one of the monitored agents (preferably one with an active vulnerability showing this issue), run:
cat /var/ossec/logs/ossec.log | grep -iE "syscollector"
If Syscollector is running correctly, you should see output similar to:
- 2025/08/22 05:12:35 wazuh-modulesd:syscollector: INFO: Starting evaluation.
- 2025/08/22 05:12:46 wazuh-modulesd:syscollector: INFO: Evaluation finished.
- 2025/08/22 06:12:47 wazuh-modulesd:syscollector: INFO: Starting evaluation.
- 2025/08/22 06:12:58 wazuh-modulesd:syscollector: INFO: Evaluation finished.
Run the following command to check for errors related to vulnerabilities, Syscollector, or synchronization on the Wazuh manager:
cat /var/ossec/logs/ossec.log | grep -iE "error|warn|crit|fatal|syscollector|sync"
For testing, the Events section should show an alert if a new vulnerability is detected or resolved. Try installing an older version of VLC Player:
https://www.videolan.org/vlc/releases/2.2.3.html
Let me know the update on this.
Bob Barrett
hasitha.u...@wazuh.com
Yes, that's exactly right—new CVEs added monthly won't trigger "Active" alerts on an unpatched system since the package inventory hasn't changed (and content updates don't generate alerts). Patching would detect the resolution during the next Syscollector scan, triggering a "Solved" alert.
For more details, you can refer to this. https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/how-it-works.html Let me know if you have more questions!
