No alerts

[Brenno Garcia]

Hello,
I took a break for a while, and when I returned, I noticed that my Wazuh instance had "stopped working."
My last alerts are from yesterday.
I had an active window monitoring setup that stopped on the 11th. The script writes to a file on the agent machine, which is then read by Wazuh.
I checked the file and confirmed it is being generated, but Wazuh isn't reading it.
I restarted the manager, and it came back up without errors, but I'm still not receiving alerts.

[Luis Carlos Valdez Bravo]

Estimado/a [brenno García ]:

Espero que este mensaje le encuentre bien. Quisiera informarle que, en caso de que continúe experimentando dificultades, no dude en comunicármelo para poder asistirle adecuadamente.

Quedo a su disposición para cualquier consulta adicional.

Atentamente,

[Wazuh] 

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/996c5c3e-654b-491a-9a8b-6221b306e4c4n%40googlegroups.com.

[Olamilekan Abdullateef Ajani]

Hello,

Since the file is still being generated on the agent machine, you need to confirm whether the agent is reading the file and forwarding it to the Wazuh manager.

On the Windows endpoint, verify and restart the agent service:
Get-Service WazuhSvc
Restart-Service WazuhSvc

Then check the agent log: Get-Content "C:\Program Files (x86)\ossec-agent\ossec.log" -Tail 100

From the logs, try to look for messages where it reads "The Wazuh agent is reading from the path being monitored," or also check for errors.

Please also confirm the <localfile> entry still points to the correct file path. For example:

<localfile>
  <log_format>syslog</log_format>
  <location>C:\path\to\your\file.log</location>
</localfile>


Then on the Wazuh manager side, check whether you are able to see the alerts in the alerts.json file: cat /var/ossec/logs/alerts/alerts.json | grep part-of-your-log

You can also check the archives. You can enable the archive log by editing the /var/ossec/etc/ossec.conf file.
<ossec_config>
  <global>
    ----  
    <logall>yes</logall>
    <logall_json>yes</logall_json>
  </global>
</ossec_config>
Then restart the Wazuh-manager.
systemctl restart wazuh-manager

cat /var/ossec/logs/archives/archives.json | grep "part of your log"
Verify that you have the logs, then disable archiving by setting the values to no.

If the log appears in archives.json but not in alerts.json, then the agent is sending the log, but no rule is matching it.

If it does not appear in archives either, then the challenge is possibly on the agent side, the file is not being monitored, the path has changed, the agent is disconnected, or the agent cannot read the file.

Please share all the details above if you require assistance analyzing the issue.

[Brenno Garcia]

Hello,

I resolved the issue.
It was a 1000/1000 shard limit, the index for the 20th hadn't been created.

[Olamilekan Abdullateef Ajani]

Hi,

Glad this has been resolved, thank you for the feedback.

Regards,