Centralized configuration

[Max Kirshin]

Hello Wazuh team and community
Please, help with issue faced during Centralized configuration implementation.
I've tried to push configuration and SCA policies using way described in "Download configuration files from remote location". I use Ubuntu, latest available Docker and Wazuh 4.14.3 single-node. I've added file "files.yml" and described it in docker-compose. This file seems to work: the group has been created and I've seen "2026/02/19 05:38:55 wazuh-remoted: INFO: Successfully parsed of yaml file: etc/shared/files.yml" in ossec.log.
But there are no files in the created group except ar.conf (and merged.mg that contains only ar.conf). Also, the attemp to view configuration agent.conf shows the error like permission or file lack.
There are these errors in the log:
2026/02/19 05:39:05 wazuh-remoted: ERROR: Cannot connect to the download module socket. External shared file download is not available.
2026/02/19 05:39:17 wazuh-remoted: ERROR: Couldn't open file 'var/download/agent.conf'
2026/02/19 05:39:18 wazuh-remoted: ERROR: Couldn't open file 'var/download/win_bitlocker.yml'.
For these files I use Github and it's permalink. I've checked with curl that they are available for downloading

[Ian Yenien Serrano]

Hi Max, I'll look into it and let you know when I find out anything. In the meantime, could you send me the logs from before and after the error in case there's any more information?

[Ian Yenien Serrano]

Can you verify that wazuh-modulesd is working?

You can test it by running: systemctl status wazuh-manager.

systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; preset: disabled)
     Active: active (running) since Fri 2026-02-20 11:44:15 UTC; 3min 34s ago
 Invocation: 88539c68010547fb9383bbc8672a5c94
      Tasks: 211 (limit: 36730)
     Memory: 2.8G (peak: 3.1G)
        CPU: 1min 29.257s
     CGroup: /system.slice/wazuh-manager.service
             ├─11834 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─11835 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─11836 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─11839 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─11842 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─11885 /var/ossec/bin/wazuh-authd
             ├─11900 /var/ossec/bin/wazuh-db
             ├─11933 /var/ossec/bin/wazuh-execd
             ├─11952 /var/ossec/bin/wazuh-analysisd
             ├─11962 /var/ossec/bin/wazuh-syscheckd
             ├─11978 /var/ossec/bin/wazuh-remoted
             ├─12044 /var/ossec/bin/wazuh-logcollector
             ├─12086 /var/ossec/bin/wazuh-monitord
             └─12137 /var/ossec/bin/wazuh-modulesd

[Max Kirshin]

Sorry, I can't manage to run it inside the docker container
bash-5.2# systemctl status wazuh-manager
bash: systemctl: command not found
But via docker logs I can see
Started wazuh-modulesd
Also, this is ps out
bash-5.2# ps aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.0    204     0 ?        Ss   12:23   0:00 s6-svscan -t0 /var/run/s6/services
root          38  0.0  0.0    204     0 ?        S    12:23   0:00 s6-supervise s6-fdholderd
wazuh        387  0.5  3.1 943876 123020 ?       Sl   12:24   0:07 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wa
wazuh        388  0.0  1.7 151668 70332 ?        S    12:24   0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wa
wazuh        389  0.0  1.7 151532 70220 ?        S    12:24   0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wa
wazuh        392  0.0  1.7 299688 69720 ?        S    12:24   0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wa
wazuh        395  0.0  1.5 443888 60348 ?        S    12:24   0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wa
root         441  0.0  0.1 110032  7780 ?        Sl   12:24   0:00 /var/ossec/bin/wazuh-authd
wazuh        455  0.1  0.5 1218424 20392 ?       Sl   12:24   0:01 /var/ossec/bin/wazuh-db
root         498  0.0  0.0  27772  3812 ?        Sl   12:24   0:00 /var/ossec/bin/wazuh-execd
wazuh        517  0.1  0.9 2477696 37476 ?       Sl   12:24   0:01 /var/ossec/bin/wazuh-analysisd
root         535  0.2  0.2 347612 10612 ?        SNl  12:24   0:03 /var/ossec/bin/wazuh-syscheckd
wazuh        754  0.1  0.3 1096328 14192 ?       Sl   12:24   0:01 /var/ossec/bin/wazuh-remoted
root         827  0.0  0.1 470312  7528 ?        Sl   12:24   0:00 /var/ossec/bin/wazuh-logcollector
wazuh        887  0.0  0.1  27744  4192 ?        Sl   12:24   0:00 /var/ossec/bin/wazuh-monitord
root         951  0.2  1.6 1089156 66284 ?       Sl   12:24   0:02 /var/ossec/bin/wazuh-modulesd
root        1571  0.0  0.0    204     0 ?        S    12:24   0:00 s6-supervise filebeat
root        1572  0.0  0.0    204     0 ?        S    12:24   0:00 s6-supervise ossec-logs
root        1576  0.0  1.2 1358000 49536 ?       Ssl  12:24   0:00 /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml
root        1577  0.0  0.0   4964  2560 ?        Ss   12:24   0:00 /usr/bin/coreutils --coreutils-prog-shebang=tail /usr/bin/tail -F
root        2452  0.0  0.0   4520  3456 pts/0    Ss   12:25   0:00 /bin/bash
root        2773  0.0  0.0   4828  2560 pts/0    R+   12:45   0:00 ps aux

пятница, 20 февраля 2026 г. в 14:51:55 UTC+3, Ian Yenien Serrano:

[Max Kirshin]

Hello team and community.
Are there any updates on this issue?

вторник, 3 марта 2026 г. в 11:17:39 UTC+3, Max Kirshin:

[Max Kirshin]

I've found that issue is related to wazuh-remoted, and particulary to 'queue/download' module

пятница, 13 марта 2026 г. в 10:26:21 UTC+3, Max Kirshin: