IT Hygiene not working completely

[Seeta Rama Raju]

Hello Wazuh Community,

I’m facing an issue where IT Hygiene is not working completely in my Wazuh environment.

Troubleshooting done:

• Wazuh manager and agents are running normally

• No indexing or dashboard errors observed
  

Any guidance or troubleshooting steps would be appreciated.  

[Anthony Faruna]

Hello RajuTo know the cause of the issue you are facing:
Can you share some details about your deployment?Is it an all-in-one or distributed deployment?
Did you upgrade your Wazuh environment recently?
Make sure there is a stable network connectivity between the indexer and the manager.

Please share the ossec.log from the manager side. using the following
cat /var/ossec/logs/ossec.log | grep errorCheck if it has the following error:

2025/10/20 08:56:30 indexer-connector: ERROR: Could not connect to server, status code: -1.
2025/10/20 08:56:30 indexer-connector: WARNING: Failed to sync agent 

This error indicates that the indexer connector that is responsible for the IT hygiene indices is sometimes not able to update, as it cannot connect and sync.Can you share the version of your Wazuh manager?Query the indexer’s health with Indexer
Indexer management > Dev Tools

 GET _cluster/health

The cluster status must be:

• Wazuh v4.8.0–v4.9.0: green
• Wazuh v4.9.1 and later: green or yellow

Looking forward to your update

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/048f423d-3b2c-43f6-ad97-c12f5160a0ddn%40googlegroups.com.

[Seeta Rama Raju]

Hello  Anthony Faruna,

My wazuh environment is  distributed deployment and my Wazuh manager version is  v4.14.1

>>cat /var/ossec/logs/ossec.log | grep error

2026/01/06 03:41:16 wazuh-modulesd:syscollector: ERROR: sqlite: COMMIT TRANSACTION. cannot commit - no transaction is active
2026/01/06 03:41:19 wazuh-modulesd:syscollector: ERROR: sqlite: COMMIT TRANSACTION. cannot commit - no transaction is active
2026/01/06 03:41:26 wazuh-modulesd:syscollector: ERROR: sqlite: COMMIT TRANSACTION. cannot commit - no transaction is active
2026/01/06 03:41:26 wazuh-modulesd:syscollector: ERROR: sqlite: COMMIT TRANSACTION. cannot commit - no transaction is active
2026/01/06 03:41:26 wazuh-modulesd:syscollector: ERROR: sqlite: COMMIT TRANSACTION. cannot commit - no transaction is active
2026/01/06 03:41:27 wazuh-modulesd:syscollector: ERROR: sqlite: COMMIT TRANSACTION. cannot commit - no transaction is active
2026/01/06 03:41:27 wazuh-modulesd:syscollector: ERROR: sqlite: COMMIT TRANSACTION. cannot commit - no transaction is active
2026/01/06 04:37:07 wazuh-integratord: ERROR: Unable to enable integration for: 'virustotal'. File not found inside 'integrations'.
2026/01/06 04:37:11 wazuh-remoted: ERROR: Unable to open file 'etc/shared/default/port.yml' due to [(13)-(Permission denied)].
2026/01/06 04:37:11 wazuh-remoted: ERROR: Invalid shared file 'etc/shared/default/port.yml'. Ignoring it.

>>grep -i inventory /var/ossec/logs/ossec.log 

2026/01/06 04:43:13 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-hotfixes-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:15 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-hardware-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:17 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-protocols-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:20 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-interfaces-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:22 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-networks-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:23 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-users-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:24 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-groups-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:25 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-browser-extensions-ip-172-31-7-160', retrying until the connection is successful.
2026/01/06 04:43:41 logger-helper: INFO: InventoryHarvesterFacade module started.
2026/01/06 04:43:41 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-services-ip-172-31-7-160', retrying until the connection is successful.

>>Indexer management > Dev Tools

GET _cluster/health:

{
  "cluster_name": "wazuh-cluster",
  "status": "yellow",
  "timed_out": false,
  "number_of_nodes": 1,
  "number_of_data_nodes": 1,
  "discovered_master": true,
  "discovered_cluster_manager": true,
  "active_primary_shards": 186,
  "active_shards": 186,
  "relocating_shards": 0,
  "initializing_shards": 0,
  "unassigned_shards": 19,
  "delayed_unassigned_shards": 0,
  "number_of_pending_tasks": 0,
  "number_of_in_flight_fetch": 0,
  "task_max_waiting_in_queue_millis": 0,
  "active_shards_percent_as_number": 90.73170731707317

[Anthony Faruna]

Hello Raju,

Please can you share the output of cat /var/ossec/logs/ossec.log | grep -iE "inventory|indexer|syscollector"

Based on the logs you shared, the issue is that the manager cannot initialize the inventory indices in the indexer. This often happens when there’s a mismatch in the <indexer> block configuration inside ossec.conf, usually related to the certificate paths.

I’d suggest double-checking that the certificate paths under <indexer> match the ones Filebeat is using on your indexer node. You can use the example here as a reference: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/indexer.html#configuration-example

Also, you can run the following command to verify which cert files are present and confirm your paths:

ll /etc/filebeat/certs/

That should help confirm whether the <indexer> block is pointing to the correct certificates.

Please could you also double-check whether your <indexer> block has the host defined like this:

<host>https://x.x.x.x:9200</host>
If it’s missing the https:// prefix and only appears as <host>x.x.x.x:9200</host>, that can cause connection errors with the Wazuh indexer.

It would also be helpful if you could run once more to see if there are any additional details in the logs explaining why the IndexerConnector initialization is failing.  :

cat /var/ossec/logs/ossec.log | grep -iE "error|warn|crit|fatal"

Regards

To view this discussion visit https://groups.google.com/d/msgid/wazuh/b22c2d57-1838-4982-8bff-0d30d8a98d9fn%40googlegroups.com.

[Anthony Faruna]

Hello Raju,

Further to my earlier message, please update the Wazuh Indexer username and password in the Wazuh manager keystore using the Wazuh-keystore tool.

I will be expecting your feedback.

Best Regards