The discrepancy between IT Hygiene, which shows Rocky Linux 9.6, and the Endpoints section, which shows the correct version (9.7), could be related to a synchronization issue between different data sources.
The Endpoints section reads data directly from the agent's local database, while IT Hygiene reads from the Wazuh Indexer's indices.
To help diagnose your problem, please provide the following:
1. Which version of Wazuh are you using?
2. Could you share the following logs?
From the Wazuh Manager:
```bash
grep -i "indexer-connector\|inventory-harvester" /var/ossec/logs/ossec.log | tail -100
```
From the affected agent:
grep -i syscollector /var/ossec/logs/ossec.log | tail -50
3. Could you share your Wazuh indexer configuration set in the Wazuh Manager's `/var/ossec/etc/ossec.conf`
4. Timeline
- When was the OS updated to Rocky Linux 9.7?
- Have you recently upgraded Wazuh?
5. Finally, could you validate the status of the indexes in the Wazuh indexer?
curl -k -u admin:<PASSWORD> "
https://localhost:9200/_cat/indices/wazuh-states-inventory-*?v"
I'm sharing the documentation of IT Hygiene
https://documentation.wazuh.com/current/getting-started/use-cases/it-hygiene.html