offline vulnerability detection

[Mushahid Bhat]

I am using version 4.8 as per documentation I am setting the configuration as 
 <vulnerability-detector>
   <enabled>yes</enabled>
   <index-status>yes</index-status>
   <feed-update-interval>60m</feed-update-interval>
   <offline-url>file:///var/ossec/etc/851035_1724671418.zip</offline-url>

But its not working Kindly provide steps to resolve

Error getting as 

2024/09/02 14:21:16 wazuh-integratord: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...

2024/09/02 14:21:17 wazuh-csyslogd: ERROR: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).
2024/09/02 14:27:21 wazuh-csyslogd: ERROR: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).
2024/09/02 14:29:52 wazuh-csyslogd: ERROR: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).

[Stuti Gupta]

Hi Mushahid Bhat

In vulnerability 4.8 it is vulnerability-detection not vulnerability-detector. Also, make sure you configured offline-update according to https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/offline-update.html

Hope this helps

[Mushahid Bhat]

its my ossec.conf file

<vulnerability-detection>

   <enabled>yes</enabled>
   <index-status>yes</index-status>
   <feed-update-interval>60m</feed-update-interval>
   <offline-url>file:///var/ossec/etc/851035_1724671418.zip</offline-url>

  </vulnerability-detection>

Its my error message below

● wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2024-09-04 11:24:43 IST; 1min 18s ago
  Process: 61205 ExecStop=/usr/bin/env /var/ossec/bin/wazuh-control stop (code=exited, status=0/SUCCESS)
  Process: 61569 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=1/FAILURE)

Sep 04 11:24:42 pcp systemd[1]: Starting Wazuh manager...
Sep 04 11:24:43 pcp env[61592]: 2024/09/04 11:24:43 wazuh-csyslogd: ERROR: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).
Sep 04 11:24:43 pcp env[61569]: wazuh-csyslogd: Configuration error. Exiting
Sep 04 11:24:43 pcpsystemd[1]: wazuh-manager.service: Control process exited, code=exited status=1
Sep 04 11:24:43 pcp systemd[1]: wazuh-manager.service: Failed with result 'exit-code'.
Sep 04 11:24:43 pcp systemd[1]: Failed to start Wazuh manager.

[Stuti Gupta]

Hi   Mushahid

Please share the ossec.conf and the changes that you made.
Also please share the wazuh-manager ossec.log located at /var/ossec/logs/ossec.log

Hope to hear from you soon