WAZUH IF MASTER NODE IS DOWN

[Claudio Lopes]

Hello guys, 

I have a question, I know if node is be down agents connected on other worker, but if master is down and agents connect to him, this agents wil move for worker ? If Master sending alerts for Syslog, if down any logs will send. But when he is on, will send alerts that didnt send for Syslog?

[Alfonso Ruiz-Bravo]

Hello Claudio!

Answering your first question, yes, if the Wazuh master node goes down, the connected agents should notice that they cannot reach their destination and should start reporting to the Wazuh worker nodes in their cluster.

If the Wazuh manager service goes down on the Master node, while it is down it will not send any alerts. It should generate the logs that caused it to go down, but after the service is down it will not generate anything. Once it recovers and is operational again it should resume its operation at the exact point where it left off for most integrations and features such as Syslog.

I hope this has been helpful.

Regards,

Alfonso Ruiz-Bravo