Multiple logger-helper ERROR in logs

[Alex Nevsen]

Hello!

I have multiple errors in logs:
Dec 4, 2025 @ 14:19:28.000 logger-helper ERROR InventoryHarvesterFacade::initSystemEventDispatcher: Failed to enqueue element: 00000000000000000078.

How can i figure out whats happened?
I have distributed deployment of wazuh 4.13.
Thanks!

[diego....@wazuh.com]

Hello Alex,

Here are some steps that should help you figure out the issue:

Initial Diagnosis
The error "InventoryHarvesterFacade::initSystemEventDispatcher: Failed to enqueue element: 00000000000000000078" from logger-helper indicates a failure in Wazuh's system inventory harvester module, likely during event queuing to the indexer in your distributed 4.13 deployment. This often stems from indexer connector issues, JSON parsing errors, or queue blockages. github

Enable Debug Logging
Add wazuh_modules.debug=2 to /var/ossec/etc/local_internal_options.conf on the manager node(s), then restart with systemctl restart wazuh-manager. Review /var/ossec/logs/ossec.log for detailed errors using grep -iE "inventory|harvester|connector|error|warn" /var/ossec/logs/ossec.log. reddit

Check Indexer Connectivity
Verify the <indexer> section in /var/ossec/etc/ossec.conf for correct IP, port, and certificates across cluster nodes. Test connectivity and inspect indexer logs: cat /var/log/wazuh-indexer/<cluster_name>.log | grep -E "ERROR|WARN". Look for "Connector initialization" warnings or shard limits (default 1000 per node). wazuh

Additional Troubleshooting Steps
Confirm inventory indices exist via Wazuh dashboard (Indexer Management > Index Management) matching wazuh-states-inventory-*; recreate if missing by restarting services. reddit
Check queue integrity: Stop manager, inspect /var/ossec/queue/inventory/ for corruption, then restart. groups.google
In distributed setups, ensure load balancer distributes agents evenly and review worker node logs. wazuh
Monitor Filebeat: cat /var/log/filebeat/filebeat | grep -iE "error|warn". wazuh
Restart all components (indexer, manager, dashboard) after changes and allow time for scans to populate data. reddit