Multigroup modified

[Andrehens Chicfici]

Hey,

I'm cleaning up my ossec.log warnings and since two or three days I sometimes see the warning:

"WARNING: Multigroup 'default,linux' was modified from outside, so it was regenerated."

How is this happening? I am editing my rules/configs via ssh or the wazuh dashboard. And how can I prevent it?

cheers

chic

[gonzalo....@wazuh.com]

Hi Andrehens!

If you’re actively making changes, seeing that warning from time to time is normal.

Common causes are:

• Editing files under /var/ossec/etc/shared/

• Modifying agent.conf

• Changing group assignments from the Dashboard

• File sync in clustered setups

If it only appears when you actually change something, that’s expected behavior and nothing to worry about.

If it shows up constantly without you touching anything, then I’d check what’s modifying files under /var/ossec/etc/shared/ (timestamps usually help).