Lists not loading

[Andrehens Chicfici]

Hey,

I have problems with all my list files:

my ossec.log tells me that loading the lists is failing.

2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malware-hashes' could not be loaded. Rule '99901' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List '/var/ossec/etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99902' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99903' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99904' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99905' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7617): Signature ID '99905' was not found and will be ignored in the 'if_sid' option of rule '99906'.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7619): Empty 'if_sid' value. Rule '99906' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99907' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99908' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99909' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99910' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99911' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99912' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99913' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99914' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99915' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99916' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-domains' could not be loaded. Rule '99917' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-domains' could not be loaded. Rule '99918' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99919' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99920' will be ignored.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7613): Rule ID '190015' does not exist but 'overwrite' is set to 'yes'. Still, the rule will be loaded.
2026/02/19 12:26:56 wazuh-analysisd: WARNING: (7605): It is not possible to overwrite 'if_group' value in rule '92213'. The original value is retained.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malware-hashes' could not be loaded. Rule '99901' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List '/var/ossec/etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99902' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99903' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99904' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99905' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7617): Signature ID '99905' was not found and will be ignored in the 'if_sid' option of rule '99906'.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7619): Empty 'if_sid' value. Rule '99906' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99907' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99908' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99909' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99910' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99911' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99912' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99913' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99914' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99915' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99916' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-domains' could not be loaded. Rule '99917' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-domains' could not be loaded. Rule '99918' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99919' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99920' will be ignored.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7613): Rule ID '190015' does not exist but 'overwrite' is set to 'yes'. Still, the rule will be loaded.
2026/02/19 12:26:57 wazuh-testrule: WARNING: (7605): It is not possible to overwrite 'if_group' value in rule '92213'. The original value is retained.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malware-hashes' could not be loaded. Rule '99901' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List '/var/ossec/etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99902' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99903' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99904' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99905' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7617): Signature ID '99905' was not found and will be ignored in the 'if_sid' option of rule '99906'.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7619): Empty 'if_sid' value. Rule '99906' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99907' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99908' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99909' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99910' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99911' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99912' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99913' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99914' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99915' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99916' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-domains' could not be loaded. Rule '99917' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-domains' could not be loaded. Rule '99918' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99919' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7616): List 'etc/lists/malicious-ioc/malicious-ip' could not be loaded. Rule '99920' will be ignored.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7613): Rule ID '190015' does not exist but 'overwrite' is set to 'yes'. Still, the rule will be loaded.
2026/02/19 12:27:01 wazuh-analysisd: WARNING: (7605): It is not possible to overwrite 'if_group' value in rule '92213'. The original value is retained.
2026/02/19 12:27:13 wazuh-remoted: WARNING: Multigroup 'default,linux' was modified from outside, so it was regenerated.

I expected the permissions to be wrong but doing ls -la on /var/ossec/etc/lists tells me:

total 92
drwxrwx--- 2 wazuh wazuh  4096 Feb 19 12:24 .
drwxrwx--- 4 root  wazuh  4096 Jan 29 10:46 ..
-rw-rw---- 1 wazuh wazuh  4870 Feb 18 12:43 malicious-domains
-rw-rw---- 1 wazuh wazuh  2764 Feb 18 12:43 malicious-ip
-rw-rw---- 1 wazuh wazuh 12935 Feb 18 12:43 malware-hashes

/var/ossec/etc/lists# ls -la
total 64
drwxrwx--- 4 root  wazuh 4096 Jan 29 10:46 .
drwxrwx--- 7 wazuh wazuh 4096 Feb 19 12:26 ..
drwxr-x--- 2 wazuh wazuh 4096 Feb 18 12:43 amazon
drwxrwx--- 2 wazuh wazuh 4096 Feb 19 12:24 malicious-ioc

Also the whole lists folder has the permissions root:wazuh like all other folders as decoders or rules.

What am I not seeing?

cheers

chic

[Olamilekan Abdullateef Ajani]

Hello Chic,

The issue with failure to load a rule associated with a CDB list is not because of the permissions but because the list was not referenced in the ossec.conf file <ruleset> section. Please see attached for further reference.

To solve this, please add the list directory to the ossec.conf file as indicated below, and that should fix the issue.

<ruleset>

    <!-- Default ruleset -->
     <list>etc/lists/malicious-ip</list>

Please let me know if you require further assistance on this. You can also follow the guide in the documentation below:

https://documentation.wazuh.com/current/user-manual/ruleset/cdb-list.html

Regards,

[Andrehens Chicfici]

Thanks! Quick & easy fix. I was wondering why those are not listed in there as default...

cheers

chic