Wazuh agent keeps crashing (windows server 2019)

[Mohd Imran]

Hi there, i'm currently interested in wazuh and already tried installing it. the feature is good and i really like it.

i have a problem where when i install agent to windows server the app stopped by itself and when i check on the event viewer log (application) the agent itself crash. i resarted the agent and after several minutes it crashes again.

appreciate your advice on this matter

[Francisco Navarro]

Hello,

First of all, please have in mind that Wazuh Windows agent’s files are stored (by default) at C:\Program Files (x86)\ossec-agent , there you could manually check your agent logs if the app crash when you try to open them. The file with the logs is called ossec.log

I’m sorry to hear about your problem. For your description, it seems to me like a recently reported and fixed issue in the Wazuh windows agent, caused by the FIM synchronization module. Please check your logs as I said and try to disable the synchronization as described in the issue to check if this is your case. The fix will be released in Wazuh 4.2, but, if that’s your problem, you could fix it following the steps described by antoniomanuelfr on this comment.

If that doesn’t solve the problem (or you don’t have version 4.1.2 or later), then try to share with us more information so we could help you (agent version, active modules, logs, app crash report, etc…),

I hope this helps,

best regards.

​

[Mohd Imran]

Hi franscisco

the above fix that you pointed out works!

many thanks