Unexpected Wazuh Indexer Disk Growth with Vulnerability Detection Enabled

[Muhammad Ali Khan]

Hello Wazuh Team,

I am observing continuous disk growth on the Wazuh indexer in a client environment and would appreciate your guidance to confirm whether this behavior is expected or if further tuning is recommended.

Environment

• Wazuh version: 4.x

• OS: CentOS 7.9

• Agents: Multiple production endpoints

• Vulnerability Detection: Enabled

Observed Issue

• The directory /var/lib/wazuh-indexer is continuously increasing in size.

• Vulnerability Detection is working correctly and data is being indexed.

• The growth persists even after reducing the vulnerability feed update interval.

Current Configuration

<vulnerability-detection>
  <enabled>yes</enabled>
  <index-status>yes</index-status>
  <feed-update-interval>24h</feed-update-interval>
</vulnerability-detection>



What is the recommended way to manage or control this growth according to Wazuh best practices?
We would appreciate your guidance on how this scenario should be handled in a production environment.
Thank you for your time and support.

[Joaquin Romera]

Hi Muhammad,

I will forward your question to the Indexer team and get back to you as soon as possible.

Best regards.

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/CAMoy60PuJ0VbBgr%2B8c54Y2p9mL4P1DSBL-QY_KcoLw27kK9%3DsA%40mail.gmail.com.