vulnerability-scanner feed ossec.log

[German DiCasas]

Hi team,

I have a log here over wazuh 4.8.2-1. All in one and agents with same version. 

cat /var/ossec/logs/ossec.log | grep -i "vulnerability-scanner"

2025/01/17 13:44:21 wazuh-modulesd:vulnerability-scanner: INFO: Starting vulnerability_scanner module.
2025/01/17 13:44:22 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started
2025/01/17 13:55:36 wazuh-modulesd:vulnerability-scanner: INFO: Initiating update feed process
2025/01/17 15:19:52 wazuh-modulesd:vulnerability-scanner: INFO: Triggered a re-scan after content update
2025/01/17 15:19:52 wazuh-modulesd:vulnerability-scanner: INFO: Feed update process completed
2025/01/17 15:19:52 wazuh-modulesd:vulnerability-scanner: INFO: Initiating update feed process
2025/01/17 15:19:54 wazuh-modulesd:vulnerability-scanner: ERROR: Error updating feed: [json.exception.out_of_range.401] array index 7 is out of range, trying to re-download the feed.
2025/01/17 15:23:35 wazuh-modulesd:vulnerability-scanner: INFO: Initiating update feed process

2025/01/17 15:56:39 wazuh-modulesd:vulnerability-scanner: INFO: Triggered a re-scan after content update
2025/01/17 15:56:39 wazuh-modulesd:vulnerability-scanner: INFO: Feed update process completed
2025/01/17 15:56:39 wazuh-modulesd:vulnerability-scanner: INFO: Initiating update feed process
2025/01/17 15:58:57 wazuh-modulesd:vulnerability-scanner: ERROR: Error updating feed: [json.exception.parse_error.101] parse error at line 1, column 16578585: syntax error while parsing object - unexpected end of input; expected '}', trying to re-download the feed.

2025/01/17 16:00:42 wazuh-modulesd:vulnerability-scanner: INFO: Initiating update feed process
2025/01/17 16:02:33 wazuh-modulesd:vulnerability-scanner: ERROR: Error updating feed: [json.exception.out_of_range.403] key 'metrics' not found, trying to re-download the feed.

What can be the issue?

Regards

German

[Dario Menten]

Hello German,

It seems there are some issues with the feeds, please try this:

1. Stop the manager
2. Disable vulnerability detector
3. Remove the inventory (`rm -rf /var/ossec/queue/vd/inventory/ `  )
4. Start manager
5. Enable vulnerability detector
6. Restart the manager (the agent should be rescanned and the index should be recreated)

I hope this could be helpful.

[German DiCasas]

That fix the issue.

What do that path? /var/ossec/queue/vd/inventory/  or the use?

thanks a lot.

German