CDB lists not showing in the interface and not working

[Arthur Henrique Oliveira Aparício]

Good morning! I've been adding custom CDB lists to my Wazuh, and I've noticed that in one of the manager instances, it doesn't show any CDBs in the interface, including the standard ones that came with some updates a few years ago and the older ones. 

I've checked permissions and everything is correct, including my custom one. However, in another instance (used for other logs), the standard ones appear (it doesn't have custom ones yet), but even creating the rule, the ruleset test doesn't validate it and the alert isn't created. So, even using malicious-ioc/malicious-ip doesn't work. 

Could you help me?

[Olamilekan Abdullateef Ajani]

Hello Arthur,

• I am trying to gather some information regarding this to better understand the issue.
• Are both managers in the same cluster (worker/master) or a different environment entirely?
• What Wazuh version are you running on both?
• On the first manager, do you see the .cdb files in /var/ossec/etc/lists/ or just the plain list files? (or just share what you have there)
• On the second manager, can you share your <list> entry in ossec.conf and the rule you’re using?  
• Please also share the content of /var/ossec/logs/ossec.log, this is to check for errors. You can share both.
• Since you also perform logtest, kindly share a sample log for evaluation.

Regards,

[Arthur Henrique Oliveira Aparício]

Hello!

I managed to solve both problems by removing the file permissions and then re-adding them. It was some kind of Linux error that was showing the correct permissions but not allowing Wazuh to access them. Thank you for your help!

[Olamilekan Abdullateef Ajani]

Hi,

I am glad this has been resolved and thank you for the feedback.

Regards,