wazuh-states-vulnerabilities backup

[Mr VR]

Hi Team,

The wazuh-states-vulnerabilities-* have two indexes are saved.

Also vulnerabilites also detect under wazuh-alerts* index.

Kindly recommend a solution to reduce the size wazuh-states-vulnerabilities* index.

Regards,

Vignesh

[Aishat Motunrayo Awujola]

Hello Vignesh,

A key thing to establish first: 

wazuh-states-vulnerabilities-* is a stateful index, not a time-series one like wazuh-alerts-*. It holds one document per (agent, active vulnerability) and reflects current inventory. Entries are removed when a vulnerability is resolved. So, its size scales with number of agents × vulnerabilities per agent × replicas, not with time.

From your screenshot, you have two indices under the wazuh-states-vulnerabilities-* pattern, but only one is live:

• wazuh-states-vulnerabilities-ip-10-0-1-10 is the active index. The Vulnerability Detection module writes to it, and at 2.3 GB it is a healthy size.
• wazuh-states-vulnerabilities-ip-10-0-1-10-backup is a static backup copy. At 16.5 GB with 27.5 million documents, it holds almost all of the storage you want to reclaim.

The fix is to delete the backup index. This reclaims the space in one step and leaves your live index untouched.

Before you delete it, two points to note:

Both indices match the wazuh-states-vulnerabilities-* pattern that the dashboard queries. The backup adds 27.5 million stale documents to every search, so it can inflate or duplicate your vulnerability counts. Removing it fixes the storage and the dashboard accuracy together.

If you keep the backup as a safety copy, use Wazuh snapshots instead of a cloned live index. Go to Snapshot Management in the left navigation, configure a repository, and snapshot the live index. You can then delete the backup safely.

To remove the backup, select its row and use Actions > Delete

  

Deletion is permanent unless you snapshot first, so confirm you no longer need the backup before you run it.

The live index has around 205,000 deleted documents, which is about 4 percent. This is minor.

Kind regards.