GB's of data in /queue/indexer/wazuh-states-vulnerabilities-wazuh_cluster/

[Mahad Mansoor]

Hey team, I am facing an issue that my manager worker disk gets full with /queue/indexer/. I have increased the disk space. I see alot of .sst files but how should I resolve this issue?

Thanks in anticipation

[Md. Nazmur Sakib]

Hi Mahad,

SST file under  /var/ossec/queue/vd:

• Occupies around 7 GB, and it contains all the vulnerability information

• This DB will grow over time, but changes won't be as substantial. It's not affected by the number of agents

SST file under  /var/ossec/queue/indexer/wazuh-states-*

• This DB is used as a queue to retain information that should be indexed

• It should grow with the number of agents, but also decrease over time (when we dispatch the queued events)

The directory stores elements that have not yet been processed by the Vulnerability Detector module. If there is no problem with the connection to Wazuh Indexer, they should be removed once processed.

If you still feel that /var/ossec/queue/ is occupying more space than it is supposed to, share the ossec.log

cat /var/ossec/logs/ossec.log | grep -iE "error|warn|indexer|vuln"

The size of the /var/ossec/queue/indexer/ folder

du -sh /var/ossec/queue/indexer/
And the number of your agents.
I look forward to your update.