Obtaining the total volume usage from last month (or other custom range)

[Joaquim António]

Hello Wazuh team,

In order to track the volume usage of each of our Wazuh deployments, we were looking at the remoted.recv_bytes as a possible source of this value.

Currently, we are exclusively receiving events via agent, and we are not storing the raw original logs (archives). 

However, we don't know how these statistics exactly work and how they are reset. So making a dashboard with the sum would probably not be an accurate measurement. How can we display the monthly cumulative/total number of bytes/GB received from the agents?

[Dennis Ariel Gamboa Veliz]

Hi Joaquim,

Thank you for your question.

Wazuh provides internal statistics, such as remoted.recv_bytes, but this value is a runtime metric. It is updated in real time and can reset when the Wazuh manager service restarts. Because of this, it is not stored historically and cannot be used to obtain an accurate monthly count of bytes received.

You can find this metric documented here:
https://documentation.wazuh.com/current/user-manual/reference/statistics-files/wazuh-remoted-state.html

Currently, Wazuh does not offer a feature that provides a reliable cumulative ingestion volume per month.

Regards,