wazuh-authd: WARNING: Duplicate name

[doc dodo]

Hello,

I use Wazuh docker with multi-node. I have problem with connect agent ro server:

2026/01/05 14:25:56 wazuh-authd: INFO: Received request for a new agent (1938-NP) from: 192.168.116.43
2026/01/05 14:25:56 wazuh-authd: WARNING: Duplicate name '1938-NP', rejecting enrollment. Agent '102' key already exists on the manager.

On server status agent is disconnected. After rebooting the master and worker nodes, the agent becomes active.  But how to solve this problem without rebooting?

[Stuti Gupta]

Hi doc dodo

Every device must have a unique ID and name. Once the device is enrolled, a unique key is generated and will be the key associated with the device. If id or name of a device is repeated(example: a vm with a wazuh agent that was enrolled, and after that it was cloned), a warning message will be logged in ossec log.

wazuh-authd: WARNING:  Duplicate name '1938-NP', rejecting enrollment. Agent '102' key already exists on the manager.

If you see a duplicate agent name warning, you should remove and re-enroll the agent.

Remove the old agent entry from the manager. Run this command on the Wazuh Manager as root:
/var/ossec/bin/manage_agents -r <id>

Replace with the old Wazuh Agent ID.
This will remove the old agent entry (note: historical alerts remain intact).

Restart the Wazuh agent service. The agent will re-register with the manager, creating a new agent ID and using the updated hostname.

For more details, you can refer to the https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/client.html#agent-name

Let me know if you need further assistance on this.

[doc dodo]

But after deleting the agent from the manager, all events will be lost. The duplication agent issue is resolved by simply rebooting the master and worker nodes. This seems like some kind of bug.

понедельник, 5 января 2026 г. в 14:54:40 UTC+3, Stuti Gupta:

[Stuti Gupta]

No, after deleting the agent, the generated event won't be lost from wazuh-dashboard. Sometimes, when wazuh-manager is not reachable, and after a few attempts, the agent tries to re-register itself as a new agent will result in a duplicate agent error. This is the reason that after restarting the manager, the agent can connect to it again without issue. If you face this issue again, then please share the log from the affect agent side and the manager as well. 

[doc dodo]

After removing the agent from the server, the problem recurs.

Server and agent is  v4.14.  The connection drops periodically.

Agent log:

2026/01/06 16:27:14 wazuh-agent: ERROR: Duplicate agent name: 2105-NP. Unable to add agent (from manager)

2026/01/06 16:27:24 wazuh-agent: WARNING: (4101): Waiting for server reply (not started). Tried: '192.168.110.95'. Ensure that the manager version is 'v4.14.1' or higher.
2026/01/06 16:27:24 wazuh-agent: WARNING: Unable to connect to any server.
2026/01/06 16:27:24 wazuh-agent: INFO: Closing connection to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:27:24 wazuh-agent: INFO: Trying to connect to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:28:34 wazuh-agent: INFO: Closing connection to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:28:34 wazuh-agent: INFO: Trying to connect to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:28:52 wazuh-agent: INFO: Closing connection to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:28:52 wazuh-agent: INFO: Trying to connect to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:28:52 wazuh-agent: INFO: (4102): Connected to the server ([192.168.110.95]:1514/tcp).
2026/01/06 16:28:52 wazuh-agent: INFO: Server responded. Releasing lock.
2026/01/06 16:28:53 wazuh-agent: INFO: Agent is now online. Process unlocked, continuing...
2026/01/06 16:28:54 wazuh-agent: INFO: Agent is now online. Process unlocked, continuing...
2026/01/06 16:28:54 wazuh-agent: INFO: Agent is now online. Process unlocked, continuing...
2026/01/06 16:31:19 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2026/01/06 16:32:06 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2026/01/06 16:32:44 wazuh-agent: ERROR: (1137): Lost connection with manager. Setting lock.
2026/01/06 16:32:44 wazuh-agent: INFO: Closing connection to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:32:44 wazuh-agent: INFO: Trying to connect to server ([192.168.110.95]:1514/tcp).
2026/01/06 16:32:44 wazuh-agent: WARNING: Process locked due to agent is offline. Waiting for connection...
2026/01/06 16:32:44 wazuh-agent: WARNING: Process locked due to agent is offline. Waiting for connection...

2026/01/06 16:32:44 wazuh-agent: WARNING: Process locked due to agent is offline. Waiting for connection...

Server log:

2026/01/06 17:05:29 indexer-connector: WARNING: Document operation failed for index 'wazuh-states-inventory-groups-wazuh' - type: 'json_parse_exception', reason: 'Illegal unquoted character ((CTRL-CHAR, code 8)): has to be escaped using backslash to be included in string value
 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 71]'
2026/01/06 17:05:29 indexer-connector: ERROR: Client error, status code: 400.

вторник, 6 января 2026 г. в 11:24:09 UTC+3, Stuti Gupta:

[Stuti Gupta]

Hi,

Let me clarify a few points.

If you are trying to enroll two agents with the same name, you must delete one of them, as this will result in a duplicate agent name error.
However, if the same agent is repeatedly trying to enroll because the Wazuh manager was temporarily unreachable, it may attempt to re-register itself as a new agent. In that case, we should first review the logs before deleting any agent.

With that said, could you please clarify which scenario applies to your case?

Additionally, please share the following details:

Manager and agent versions
You mentioned that both the manager and agent are on v4.14, but the logs indicate the agent version is v4.14.1. If the agent version is higher than the manager, this can cause issues. Please ensure the manager version is the same as or higher than the agent version for stable communication.

Agent hostname or name configuration
Ensure the agent name is unique and does not match an already enrolled agent. You can explicitly set a unique agent name in ossec.conf:

<client>
 ...
 <enrollment>
 <agent_name>EXAMPLE_NAME</agent_name>
 ...
 </enrollment> </client>

Agent removal method
Please let us know how the agent was removed.

Current agent list
Share the output of the following command:
/var/ossec/bin/agent_control -l

Network connectivity
Verify that all required ports are open by following the documentation below:
https://documentation.wazuh.com/current/user-manual/agent/agent-enrollment/troubleshooting.html#verifying-communication-with-the-wazuh-manager

Once we have these details, we can better identify the root cause and guide you accordingly.