Event size exceeds the maximum allowed limit

[CJK]

Hi Team,

How can this be fixed? Can someone help?
This is the log from ossec.log of the cluster node that has the Azure Vnet integration.

2026/03/06 11:04:57 wazuh-modulesd:azure-logs: INFO: Starting Storage log collection for 'azure-flow-logs'.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: ERROR: Message too long to send to Wazuh.  Skipping message...
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: ERROR: Message too long to send to Wazuh.  Skipping message...
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: ERROR: Message too long to send to Wazuh.  Skipping message...
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: ERROR: Message too long to send to Wazuh.  Skipping message...
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: ERROR: Message too long to send to Wazuh.  Skipping message...
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: WARNING: WARNING: Event size exceeds the maximum allowed limit of 65535 bytes.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: ERROR: Message too long to send to Wazuh.  Skipping message...
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: INFO: Finished Storage log collection for container 'insights-logs-flowlogflowevent'.
2026/03/06 11:07:52 wazuh-modulesd:azure-logs: INFO: Finished Storage log collection for 'azure-flow-logs'.

Thanks & Regards

Clint

[hasitha.u...@wazuh.com]

Hi CJK, 

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.

[CJK]

Hi Hasitha,

Sure. Thanks.

[hasitha.u...@wazuh.com]

Hi CJK,

Currently, Wazuh has a limitation on the size of the events it can collect, which is mainly given by the size of the buffer for storing variables and sockets, this buffer has a fixed size of 64KB.
Previously, the buffer had a size of 6KB but as it was noticed that some events had a bigger size, this limit was taken up to 64KB, but statically. Currently, we have received reports that other events can exceed the size of 64KB and Wazuh is not able to collect them.
https://github.com/wazuh/wazuh/issues/17689

Due to this reason, it would require extending it to both the manager and the agent. We've got similar issues (such as wazuh/wazuh#7048) that we've closed as unplanned. Therefore, currently, there is no option to increase this.

However, I will check internally on this and make sure any progress is being made or not.