no medium/critical alerts withing wazuh dashboard

[Yazid Rabah]

For the past two months, Wazuh has not been displaying any alerts on the dashboard.

During this period, we experienced a brute-force attack against our firewall, but Wazuh did not detect or generate any alerts related to it.

Additionally, considering the large number of endpoints in our environment, it is highly unlikely that no security events or alerts would have been generated during this time.

The only security solution that has not been integrated with Wazuh is our EDR. All other relevant systems are integrated, yet no alerts are appearing on the dashboard.

[Stuti Gupta]

Hi yazid,

First, please check alerts.log and verify whether today's alerts are present. If there are no alerts, it means the Wazuh manager is not receiving events. In that case, please check the Wazuh manager status and logs:
systemctl status wazuh-manager
cat /var/ossec/logs/ossec.log


If today's alerts are present in alerts.log, the issue is likely related to Filebeat or the Wazuh Indexer.

First, verify that Filebeat is working correctly by running:
filebeat test output


If this command returns any errors, please share the Filebeat log:
cat /var/log/filebeat/filebeat


If Filebeat is working correctly, move on to the Wazuh Indexer.
Check the Wazuh Indexer service status:
systemctl status wazuh-indexer


If the service is active, verify whether today's index has been created:
curl -k -u admin:<PASSWORD> "https://<IP_ADDRESS>:9200/_cat/indices?v" | grep 2026.08.03


Also, check the cluster health:
curl -k -u admin:<PASSWORD> "https://<IP_ADDRESS>:9200/_cluster/health?pretty"


Finally, please share the outputs of the above commands along with the Wazuh Indexer log:
cat /var/log/wazuh-indexer/wazuh-cluster.log