wazuh agent event not display on wazuh dashboard

[beletech shewayirga]

why ? and how to fix it?

[Olusegun Adenrele Oyebo]

Hello Beletech,

Is this issue specific to just an agent or all the agents in your environment? 

Also, are you having this issue with just a particular event, or no events is showing on the dashboard? Will need more clarity on this.

Is the agent service running? Kindly confirm the status of the service using the below commands depending on the OS version:

• Windows (cmd): sc query wazuhsvc
• Linux: systemctl status wazuh-agent
• Mac: /Library/Ossec/bin/wazuh-control status

Also, confirm that the agent is connected to the Wazuh manager and is active on the Wazuh dashboard.

If the above have been confirmed okay, check the /var/ossec/logs/alerts/alerts.log file to see if you're seeing any alerts generated from the affected agent(s).

Next, check if filebeat is running by doing a test with command filebeat test output.

Next, you can check the Wazuh indexer logs for error/warning related entries that could give more clue into the issue:

• cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn|crit|fatal"

Will be expecting your feedback. 

Best regards.