Increase number of characters and filesize

[Massimiliano De Falco]

Good morning,
is possible increase the number of characters and filesize of a path.

I find this warning in endpoint ossec.log:

2023/12/15 08:37:11 wazuh-agent: WARNING: (6720): The path '<path>' is too long. The maximum length is 260 characters.

and 

2023/12/15 00:24:51 wazuh-agent: WARNING: '<path>' filesize is larger than the maximum allowed (1024 MB). File skipped.

I have this error only in one endpoint that is user's file sharing, so the solution will be for only one endpoint (not for all).

Thanks.

[Olusegun Adenrele Oyebo]

Hello  Massimiliano,

Thank you for using Wazuh!

Please give me sometime to review this issue. Will provide you with an update as soon as possible.

Best regards.

[Olusegun Adenrele Oyebo]

Hello  Massimiliano,

Thanks for your patience.

May I know the version of Wazuh you're using and also the version of the OS of the affected endpoint where the agent is installed on. Will be expecting your feedback so as to assist you further.

Best regards.

[Massimiliano De Falco]

Good morning,

the wazuh server is the v.4.7.0 on ubuntu and the wazun endpoint is the 4.7.0 on Win Server 2019

[Olusegun Adenrele Oyebo]

Hello Massimiliano,

Thanks for your patience.

When you set report_changes="yes", the Wazuh agent saves a snapshot of every file in its folder. So let's say you want to monitor the file "C:\Users\admin\Documents\File\wazuh-agent.msi", it will now be copied to "C:\Program Files (x86)\ossec-agent\queue\diff\file\ac23bd5c3b520af8482a9aa5aa1149f24c90331e\last-entry.gz". So the snapshot path is larger than the original one and the limit is 260 bytes on Windows. That seems to be the reason why you are getting the error "2023/12/15 08:37:11 wazuh-agent: WARNING: (6720): The path '<path>' is too long. The maximum length is 260 characters."

For the second error which warns about the file size, the agent has a 1GB (1024MB) limit for monitored files. You can extend it up to 4095MB by adding the below line to the agent's local_internal_options.conf file which is located in the directory C:\Program Files (x86)\ossec-agent\local_internal_options.conf (reference) and add the below:

• syscheck.file_max_size=4095

Open command line as administrator and restart the wazuh agent service with command net stop WazuhSvc && net start WazuhSvc for the updated configuration to take effect.

I hope this helps. Do not hesitate to reach out again if you have any other query.

Best regards.