Issue to enable <logall_json> when <logall> is disabled

[Uni AT]

Dear Wazuh community,

We are currently facing an issue to configure the generation of JSON files only by the Wazuh servers.

Our deployment consists of 3 Wazuh Server docker containers (v4.14.6) with an OpenSearch integration for logs indexing. Our goal is to make the servers generate only JSON files for alerts and archives.

When modifying the /var/ossec/etc/ossec.conf file of each Wazuh Server to disable the generation of LOG alerts and archives files (by configuring the options <alerts_log>no</alerts_log> and  <logall>no</logall>) and enabling the generation of JSON alerts and archives files (by configuring <logall_json>yes</logall_json> and <jsonout_output>yes</jsonout_output>), the settings for <logall_json> changes from yes to no after restarting the containers; although no other configuration file that could possibly override this setting has been found.

File content before containers restart:

<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>no</alerts_log>
    <logall>no</logall>
    <logall_json>yes</logall_json>
  (...)
  </global>

File content after container restart:

<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>no</alerts_log>
    <logall>no</logall>
    <logall_json>no</logall_json>
  (...)
  </global>

However, if we enable to generation of LOG alerts and archives files (by configuring <logall>yes</logall>), enabling the generation of JSON alerts and archives is well taken into account after restarting the containers.

File content before and after container restart:

<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>no</alerts_log>
    <logall>yes</logall>
    <logall_json>yes</logall_json>
  (...)
  </global>

Somehow, it looks like it doesn't accept the config line <logall_json>yes</logall_json> along with <logall>no</logall>. Do you have an idea why?

Thanks you very much in advance,

[Bony V John]

Hi,

Please allow me some time, I'm working on this and will get back to you with an update as soon as possible.

[Bony V John]

Hi,

First, I would like to clarify that the <logall_json> and <logall> options are independent. There is no dependency between them.

If you configure only <logall_json>yes</logall_json>, it will work independently. The same applies to <logall>. You can refer to the Wazuh global configuration documentation for more details.

Regarding the Docker setup, if you directly modify /var/ossec/etc/ossec.conf inside the Wazuh manager container, the changes will not remain after a restart. The file is generated from the configuration mounted from the host, so your changes will be overwritten whenever the container restarts.

You need to update the configuration files on the host instead.

For the manager node, update:

wazuh-docker/multi-node/config/wazuh_cluster/wazuh_manager.conf

For the worker node, update:

wazuh-docker/multi-node/config/wazuh_cluster/wazuh_worker.conf

After updating both files, restart only the Wazuh server containers:

cd /root/wazuh-docker/multi-node 

docker compose restart wazuh.master wazuh.worker

Then verify the configuration inside the manager container:

docker exec wazuh.master grep -E \
'jsonout_output|alerts_log|logall>|logall_json' \
/var/ossec/etc/ossec.conf

Also verify it on the worker container:

docker exec wazuh.worker grep -E \
'jsonout_output|alerts_log|logall>|logall_json' \
/var/ossec/etc/ossec.conf

Please do not permanently edit /var/ossec/etc/ossec.conf inside the container. Always make the changes in wazuh_manager.conf and wazuh_worker.conf on the host.

[Uni AT]

Hello,

Thank you for your answer. The file modifications were done on the host, not inside the containers.

What was done was exactly this:

1. Shutdown wazuhserver[01|02|03]

2. Update /var/ossec/etc/ossec.conf  oo each wazuh server on the host (a volume is mapped in the docker-compose.yml file so that the changes done in /var/ossec/ on the host are reflected within the containers).

3. Restart wazuhserver[01|02|03]

We didn't face any particular issue when modifying different settings from the ossec.conf file; the changes were always reflected in the containers. But not in this case.

Meanwhile, I tried to modify the file of each wazuhserver directly in the GUI + restarting them also from the GUI. It worked.

Below a screenshot of wazuhserver01 node after restart (similar output for wazuhserver02 / wazuhserver03):

Do you happen to know what might have caused this behaviour of reverting back the changes for <logall_json> after the server restart when I did it from the CLI, but saved successfully when done from the GUI?

Thanks a lot,