Every Wazuh error message and symptom in this tutorial, in one place. Find the string, read the likely cause, open the lesson section that fixes it. Entries with a literal message are grouped by component below; behaviour with no message is collected at the end under the same component headings.
Three log files answer most questions. The manager writes to /var/wazuh-manager/logs/wazuh-manager.log, the indexer to /var/log/wazuh-indexer/wazuh-indexer.log, and a Linux agent to /var/ossec/logs/ossec.log. On macOS that is /Library/Ossec/logs/ossec.log, and on Windows it is ossec.log in the agent folder under C:\Program Files (x86)\ossec-agent. Active response writes separately, to active-responses.log in the same agent log directory.
Enrolment is where most first-week failures land, so the official agent enrolment troubleshooting page is worth keeping open beside this one.
Entries marked beta5 lab were reproduced on a real Wazuh 5.0.0-beta5 stack rather than taken from the documentation, so the wording is exact.
Installation and upgrade
| Error or symptom | Likely cause | Fix |
|---|---|---|
Cannot find wazuh-install-files.tar. Run the script with the option -g|--generate-config-files to create it or copy it from another node. |
A per-component install was run without the certificate bundle in the working directory. | install on Ubuntu |
Cannot install dependency: <PACKAGE>. |
The package repository is unreachable or the GPG key failed to import. | install on Ubuntu |
./wazuh-certs-tool.sh: line 894: mapfile: command not found |
beta5 lab. The certificate tool was run on a shell older than bash 4, which on macOS is the system default. No certificates are produced. Run it inside a Linux container with bash 4 and GNU awk. | Docker deployment |
awk: syntax error at source line 7 from wazuh-certs-tool.sh |
beta5 lab. The tool needs GNU awk. The BSD awk on macOS and the BusyBox awk in minimal containers both fail here, usually alongside a run of sed: ... unused label messages. |
Docker deployment |
ERROR: Invalid config file path. from wazuh-certs-tool.sh |
beta5 lab. Seen on macOS as the first symptom of the same bash and awk problem, even when config.yml is present and readable. |
Docker deployment |
ERROR: (5362): Unexpected status code in Wazuh agent package uninstallation request: 401 |
Anti-tampering rejected the removal: the API token in the validation file is invalid or expired. | Linux agent |
ERROR: Uninstallation not authorized, aborting... |
The manager refused the uninstall request because the validation credentials are wrong or expired. | hardening Wazuh |
ERROR: Validation host not provided. Uninstallation cannot be continued. |
Anti-tampering is enabled and the uninstall validation file is missing or incomplete. | Linux agent, hardening Wazuh |
Port 9200 is being used by another process. Please, check it before installing Wazuh. |
Something already holds a port the assistant needs, usually an old OpenSearch or Wazuh 4.x install. | install on Ubuntu |
The current system does not match with the list of supported systems. The installation may not work properly. |
The operating system is not Amazon Linux 2023, Ubuntu 24.04 or 26.04, or RHEL 9 or 10. | install on Ubuntu, system requirements |
Uncompatible system architecture: <ARCH>. Supported any 64-bit system |
A 32-bit host. The assistant supports x86_64 and AARCH64 only, and the message is misspelled in the script. | system requirements |
UPGRADE BLOCKED: Incompatible version detected |
An agent package was upgraded straight to 5.0.0 from a version earlier than 4.14.0. | 4.x to 5 migration, what changes in 5 |
Your system does not meet the recommended minimum hardware requirements of 8Gb of RAM and 4 CPU cores. The installation will continue, but it may not work properly. |
The host is under the 4 core, 8 GB floor the assistant checks before an all-in-one install. | install on Ubuntu, system requirements |
Agent enrolment and connection
| Error or symptom | Likely cause | Fix |
|---|---|---|
401 Invalid client authentication |
Generic by design: clock skew, a key mismatch or a disallowed source address all return it. | agent disconnected, agent enrolment |
A connection attempt failed because the connected party did not properly respond after a period of time (...) |
The TCP test to 1517 or 55000 timed out: a firewall is in the way, or the manager is not listening there. | Windows agent |
Agents get 401 from one node and not another |
Clock skew on that node, or a certificate rolled on some managers and not others. | cluster |
ERROR: Invalid agent name: localhost.localdomain (from manager) |
The agent name is already registered, usually because two endpoints share a hostname. | agent disconnected, Windows agent |
ERROR: Invalid group: <group>. Unable to add agent (from manager) |
The agent named a group in the enrolment block that does not exist on the manager, so the whole enrolment is rejected. | 4.x to 5 migration, agent groups, agent disconnected |
ERROR: Enrollment rejected by the manager: invalid or missing authentication. Invalid client authentication |
beta5 lab. The agent’s enrolment password does not match authd.pass on the manager. The agent retries every few seconds and status in wazuh-agentd.state stays pending. |
agent disconnected, agent enrolment |
ERROR: Enrollment rejected by the manager: invalid request. Invalid Group(s) Name(s) |
beta5 lab. The agent declared a group in <enrollment><groups> that does not exist on the manager. The manager logs wazuh-manager-authd: ERROR: Invalid group: <group> at the same moment. |
agent groups, what changes in 5, agent disconnected |
ERROR: Invalid TLS 1.3 cipher suite list: '<value>' followed by ERROR: Could not set up SSL connection! Check certification configuration. |
The agent’s enrolment cipher option still holds a 4.x OpenSSL cipher string; 5.0 enrolment is TLS 1.3 only. | 4.x to 5 migration |
INFO: No port in <agent><manager><endpoint>. Using the default port 1517. |
beta5 lab. Not an error. The endpoint was written without a port and the agent defaulted to 1517. It appears twice per start. | 4.x to 5 migration, Linux agent |
INFO: https_client: clock skew of <N> s detected against the manager's response (Date header) during enrollment; correcting the signing timestamp and retrying. |
beta5 lab. Not an error, and not harmless. The agent’s clock is out, it read the correct time from the manager’s Date header, re-signed and enrolled. The endpoint reaches active while the manager logs a rejection. Fix the clock. |
agent disconnected, Windows agent |
INFO: https_client: clock skew of <N> s detected against the manager's response (Date header); correcting the token timestamp for this and future requests. |
beta5 lab. The same correction applied to ongoing requests rather than to enrolment. A negative value means the agent is unwinding a correction after the clock was fixed. | agent disconnected |
WARNING: Rejected <N> request(s) in the last 90 s whose token fell outside the accepted time window (stale_token). Check clock synchronization between the agents and the manager; the window is set by 'jwt_max_age' and 'jwt_clock_skew' (remoted internal options). |
beta5 lab. From wazuh-manager-remoted:endpoints. An agent’s JWT had expired on arrival, so the request was thrown away. Aggregated over 90 seconds, so one line can stand for one endpoint or for hundreds. Fix the endpoint clock rather than widening the window. |
agent disconnected, Windows agent |
The computer did not resync because no time data was available. |
beta5 lab. From w32tm /resync on a Windows endpoint: there is no reachable time source, which is the cause behind the stale_token warning rather than a separate fault. |
agent disconnected |
wazuh-manager-authd: ERROR: Invalid group: <group> |
beta5 lab. The manager-side half of a rejected enrolment: this is the name it objected to. | agent groups, agent enrolment |
ERROR: Unable to read CA certificate file "/var/ossec/etc/rootCA.pem" |
Manager identity verification is on but the CA bundle is not at the path the agent is configured with. | agent disconnected, Linux agent |
ERROR: Unable to read CA certificate file "/var/wazuh-manager/etc/rootCA.pem" |
The CA file named in the manager’s enrolment block is absent, so the enrolment daemon exits. | agent enrolment |
ERROR: Unable to read private key file: /var/ossec/etc/sslagent.key |
Agent identity verification is configured but the private key is not at the configured path. | agent enrolment |
WARNING: (1404): Authentication error. Wrong key or corrupt payload. Message received from agent '001' at 'any'. |
The key in the agent’s client.keys does not match the manager’s entry for that agent. | agent disconnected, agent enrolment |
Manager
| Error or symptom | Likely cause | Fix |
|---|---|---|
(1244): Invalid configuration at '/remote/https/certificate': file not found: |
The HTTPS agent listener has no certificate or key at the configured path, and startup is fail-closed. | cluster, agent disconnected |
Cannot start the HTTPS agent listener: |
The certificate pair exists but the service user cannot read it. | cluster |
ERROR: (1244): Invalid configuration at '/auth/ssl_auto_negotiate': unknown option (does not satisfy 'additionalProperties') [schema /properties/auth] |
A 4.x option was carried into the manager configuration, and the 5.0 schema rejects unknown options. | 4.x to 5 migration, what changes in 5 |
ERROR: Invalid TLS 1.3 cipher suite 'HIGH' in 'ciphers' option |
The enrolment ciphers option still holds a 4.x OpenSSL cipher list instead of TLS 1.3 ciphersuite names. | what changes in 5 |
HTTP 503 from the manager to agents |
The manager is shedding load on the HTTPS channel rather than buffering it. | performance tuning |
wazuh-manager-remoted:forwarder: WARNING: The inventory sync server answered HTTP 503 for 3 request(s) in the last 90 s; answering 503. |
beta5 lab. The inventory synchronisation server rejected the manager’s requests, so wazuh-states-fim-files, wazuh-states-inventory-* and wazuh-states-vulnerabilities stay empty while events and findings keep flowing. Seen repeatedly on a stock beta5 stack, so treat it as a beta issue rather than a misconfiguration. |
file integrity monitoring, vulnerability detection |
wazuh-manager-modulesd:content-updater: INFO: IndexerDownloader: Consumer 'cti:catalog:consumer:vulnerabilities' is still running in '.wazuh-cti-consumers'. Waiting 60s before retrying. |
beta5 lab. Not an error. The CVE feed is still downloading; the following line reports it ready. | threat intelligence, vulnerability detection |
Indexer and dashboard
| Error or symptom | Likely cause | Fix |
|---|---|---|
Application Not Found |
The dashboard configuration file was not updated during an upgrade and the default route is wrong. | dashboard tour |
Could not connect to API with id: default: 3003 - Missing param: API USERNAME |
The dashboard configuration is missing the manager API credentials or names the username key wrongly. | dashboard tour |
Invalid username or password after enabling SAML |
The internal authentication domain was removed or left challenging, so the local login path broke. | SSO and RBAC |
no permissions for [indices:data/read/search] and User [name=<user>, backend_roles=[], requestedTenant=null], with status 403 |
beta5 lab. Correct behaviour: the tenant’s indexer role does not name that index, so the request is refused rather than filtered to nothing. Seen against wazuh-agent-config from a role covering only events, findings and states. |
multi-tenant |
Permission denied on the manager API for a tenant user |
The manager API policy is scoped to a group, and the action attempted cannot be scoped to one. | multi-tenant |
Saved object for index pattern not found |
The saved object defining the index pattern is gone, typically after the indexer was reinstalled. | dashboard tour |
securityadmin.sh cannot connect |
The wrong host was passed, or the certificate paths do not exist. | SSO and RBAC |
Unable to lock JVM Memory |
Memory locking is enabled but the system limit was never raised, so the lock request failed. | performance tuning |
Wazuh manager API seems to be down |
The dashboard cannot reach the manager API on 55000. | dashboard tour |
Detection content (decoders, rules, API)
| Error or symptom | Likely cause | Fix |
|---|---|---|
400 Bad Request when creating or updating a detector |
More than 100 rules were selected, or the selection spans both the Standard and Custom spaces. | Sigma rules and ATT&CK |
401 Unauthorized on every request after the first few minutes |
The JWT expired. The default token timeout is 900 seconds. | API with Python |
403 Forbidden on an endpoint that works in the dashboard |
RBAC: the account your script authenticates as lacks the action the endpoint declares. | API with Python |
403 from the content update endpoint |
On-demand content updates are switched off, which is the expected air-gapped configuration. | threat intelligence |
404 on /sca, /syscheck or /syscollector |
Those paths do not exist in the 5.0 API. The state indices on the indexer replace them. | API with Python |
429 Too Many Requests |
The API is rate limiting, usually a loop of single-item calls where a list parameter exists. | API with Python |
405 with Incorrect HTTP method for uri [/_plugins/_content_manager/integrations] and method [GET], allowed: [POST] |
beta5 lab. Content Manager collection endpoints are POST-only. There is no list or read operation, so your pipeline has to record the identifiers it creates. | what changes in 5, Sigma rules and ATT&CK |
Cannot remove decoder [<uuid>] as it is set as root decoder. |
The decoder is still attached to the integration’s root decoder slot. | custom decoder |
Changes object is required |
beta5 lab. A promote request was sent without the changes object describing what to move. | custom decoder, custom rules |
content_type_header_exception with only one Content-Type header should be provided |
beta5 lab. The request carried two Content-Type headers, usually because a script adds one and the HTTP client adds another. The content is never created. |
custom decoder, custom rules |
Content of 'decoders' cannot be added or removed via update. Please use the specific resource endpoints. |
beta5 lab. A PUT to integrations/{id} tried to attach or detach a decoder. Use the decoder endpoints, or the dashboard, and send the full resource including enabled on an update. |
custom decoder |
Invalid request body.mapping values are not allowed here |
beta5 lab. A YAML resource was posted with its --- document marker or comments still in place, inside a JSON envelope. Strip both before nesting the document under resource. |
custom decoder |
Logtest is only supported for the 'test', 'custom' and 'standard' spaces. Received space: 'draft'. |
beta5 lab. Log test cannot run against draft content. Promote to the test space first. | custom decoder, custom rules |
The 'test' environment does not exist. |
beta5 lab. Log test was called against a test space that has never received a promotion. | custom decoder, custom rules |
Integration with ID '<uuid>' is not in draft space. |
You are editing content that has already been promoted; only the draft space is writable. | custom decoder, custom rules |
Invalid 'id' format. |
The identifier is empty, over 256 characters, or contains control characters. | custom decoder |
Invalid request body |
A stray top-level key. The create and update schemas refuse anything outside integration and resource. | custom rules |
Missing [<field_name>] field. |
The Content Manager rejected the request envelope: a create needs both integration and resource. | custom decoder, custom rules |
Notifications and Active Response
| Error or symptom | Likely cause | Fix |
|---|---|---|
400 Bad Request when saving an Active Response monitor |
The monitor targets an index outside the findings pattern, runs slower than a minute, or uses the wrong trigger type. | SOAR |
Monitor cannot be created or a limit error on creation |
The per-user monitor limit has been reached. | notifications |
Cloud, containers and modules
| Error or symptom | Likely cause | Fix |
|---|---|---|
Attention: This documentation covers an upcoming release |
Not an error: the beta documentation banner on cloud pages, several of which moved during the beta. | cloud logs |
Failed to connect to Wazuh indexer port 9200 |
During startup this is normal: the dashboard polls the indexer until it answers. If it persists, the indexer is unhealthy. | Docker deployment |
Get-WinEvent : There is not an event log on the localhost computer that matches "Microsoft-Windows-Sysmon/Operational". |
Sysmon is not installed, or the installation failed. | Sysmon |
ImagePullBackOff on the DaemonSet pods |
The pinned beta image tag no longer exists in the registry. | Docker and Kubernetes monitoring |
Wazuh dashboard server is not ready yet |
The same startup race seen from the browser instead of the container logs. | Docker deployment |
wazuh-logcollector: INFO: (1950): Analyzing file: '<log_file_configured>'. |
Not an error. This line confirms Logcollector opened the file; its absence after a restart is the signal. | log collection |
Symptoms without an error string
These entries describe behaviour rather than a message. The headings match the groups above.
Installation and upgrade
| Error or symptom | Likely cause | Fix |
|---|---|---|
| A 4.x agent refuses to upgrade to 5.0.0 | Expected. Direct upgrades to 5.0.0 from 4.14.0 or earlier are not supported. | upgrade and retention |
agent_upgrade reports the agent is already up to date |
Version validation compared against the repository’s latest build, not the version you intended. | upgrade and retention |
| The dashboard says it is not ready | The dashboard started before the indexer finished initialising and is retrying on 9200. | install on Ubuntu |
| The import fails with the agent ID already in use | The insert endpoint ran twice, or the ID already exists from a test enrolment on the new manager. | 4.x to 5 migration |
| The proof of concept is sized on alert volume, not event volume | Wazuh 5.0 indexes every event, not only rule matches, so the pilot box hides the real volume. | Wazuh compared |
| The upgrade never completes and the agent stays on the old version | The upgrade task is stalled in the task manager rather than failing in the package. | upgrade and retention |
| Two SIEMs end up ingesting the same sources during a bake-off | Two platforms collecting the same sources during a bake-off double the endpoint load and the findings. | Wazuh compared |
Agent enrolment and connection
| Error or symptom | Likely cause | Fix |
|---|---|---|
A <localfile> appended to the Windows ossec.conf by script is never read |
beta5 lab. The shipped file ends with a comment after the final </ossec_config>, so an insertion anchored on the end of the file matches nothing and writes nothing. |
log collection |
A Restart-Service -Name wazuh step fails on every Windows endpoint |
beta5 lab. The MSI registers one service, named WazuhSvc. Several beta documentation pages use wazuh, which does not exist. |
Windows agent, cheat sheet |
| A Wazuh 4.x agent will not connect to a 5.0 manager | beta5 lab. Not the default: the shipped configuration enables the legacy block on 1514 with enrolment on 1515. Look at the agent version floor and at allow_higher_versions, or at whether someone removed the block. |
what is Wazuh |
| A Windows endpoint shows active but the manager logs a rejected request | beta5 lab. The agent self-corrected a clock skew from the manager’s Date header, so the dashboard looks healthy while the first request of each enrolment is discarded. |
agent disconnected, Windows agent |
A Windows fleet inventory filtered on os.platform returns nothing |
beta5 lab. GET /agents returns an empty os.platform for Windows agents while Linux agents return ubuntu or amzn. Filter on os.name. |
Windows agent |
A Windows saved search or rule using winlog.* matches nothing |
beta5 lab. There are no winlog.* fields in Wazuh 5.0. The event ID is event.code, the channel is event.dataset, and the raw XML is event.original. |
log collection |
| Agents cannot reach the manager although port 1517 is open | beta5 lab. The probe is aimed at the root path. The listener is mounted under <global_prefix>, which ships as /wazuh-manager/, and the bind address ships as 0.0.0.0 rather than loopback. |
what is Wazuh |
| Agents enrol but immediately disconnect | Most often the endpoint clock is out of step with the manager, or the group does not exist. | install on Ubuntu |
| Agents show Active but the count keeps dropping | Two endpoints share one identity and take turns holding the connection. | agent disconnected |
| Connectivity that looks fine but is not | The port test passes but the listener is bound to an address the agent is not reaching. | agent enrolment |
| Enrolment rejected for a new node | The group named in the agent configuration does not exist yet, and 5.0 will not fall back to default. | Docker and Kubernetes monitoring, multi-tenant |
| Everything is stuck in Pending | The connection request arrived and authentication never finished: certificates, password, group or clock. | agent disconnected |
repeated_offenders set in agent.conf has no effect |
The option cannot be distributed through centralised configuration, and Windows agents do not support it. | agent groups, active response |
| The agent connects but gets no shared configuration | It enrolled without a groups tag and landed in default. | agent groups |
| The agent starts but never reaches Pending | Nothing is reaching the manager: the port is filtered, or the listener is bound to loopback. | Linux agent |
| The dashboard shows the configuration as not synchronised | The agent has not checked in since the change, or its keepalive interval is long. | agent groups |
| The service installs but will not start | The configuration file failed to parse after a hand edit, so the service never wrote its first log line. | Windows agent |
| The whole group stops receiving configuration after an edit | An invalid or 4.x-era agent.conf stops the shared configuration compiling for the whole group. | agent groups |
| Workers reject enrolment after a password rotation | The enrolment password is held on the master and a worker rejects enrolment until it receives the file. | hardening Wazuh |
Manager
| Error or symptom | Likely cause | Fix |
|---|---|---|
| A worker joins and then disappears | Two nodes are configured with the same node name and one of them is rejected. | cluster |
Nodes never appear in cluster_control -l |
The shared key differs between nodes, the bind address is loopback, or 1516/TCP is filtered. | cluster |
| Rules are migrated from 4.x by copying files | There is no supported path for copying 4.x rules, decoders or lists into a 5.0 installation. | Wazuh compared |
Startup fails after editing wazuh-manager.conf |
An element the 5.0 manager does not know. Several 4.x tuning options moved under the legacy block. | performance tuning |
wazuh-manager-authd will not start after touching the password file |
The password file exists but is empty or invalid, which the daemon treats as fatal. | hardening Wazuh |
Indexer and dashboard
| Error or symptom | Likely cause | Fix |
|---|---|---|
| A tenant can edit a monitor that is not theirs | Backend-role filtering for alerting is still at its default of false. | multi-tenant |
| A tenant user logs in and sees nothing | The document-level security query names a field that is absent or spelled differently, so it matches nothing. | multi-tenant |
| A tenant user sees other tenants’ agents | A second mapped role, an analysed-field match on a hyphenated tenant name, or an agent in two groups. | multi-tenant |
| A user has administrator rights they should not | An identity provider group reused across two mappings, or a user mapped to a second role. | SSO and RBAC |
| Data disappeared after an hour | Default retention on the events stream. Findings are the durable record at 90 days. | upgrade and retention, compliance |
| Disk fills far faster than the estimate | Retention was extended, a verbose source was onboarded, or unclassified event indexing was switched on. | system requirements |
| Index templates revert after a restart | Wazuh-managed index templates were hand edited, and the Setup module rewrites them on startup. | performance tuning |
| LDAP authentication stops when the directory does | Platform accounts are not in the skip list, so they are looked up in the directory as well. | SSO and RBAC |
| No data anywhere | Ask the indexer directly before blaming the dashboard: the backing indices may not exist. | dashboard tour |
| Nothing appears in the dashboard even though the manager log looks healthy | Events reach the indexer, but findings only exist once a detector runs against them. | what is Wazuh |
| Retention reverted after an upgrade | An index template was edited instead of the ISM policy, so the Setup module reset it. | upgrade and retention |
| Role mapping saved but the user still has old permissions | Run-as is not enabled in the dashboard configuration, or the browser is holding an old session. | multi-tenant, SSO and RBAC |
Searching for rule.level or full_log returns nothing |
Those are 4.x field names. The Common Schema renamed them. | what is Wazuh |
| Snapshot repository registration fails | The repository path is unset on some nodes, wrongly owned, or the indexer was not restarted after the change. | upgrade and retention |
| SSO succeeds but the user has no permissions | The backend role in the assertion does not match the mapping, the Wazuh-side mapping is missing, or run-as is off. | SSO and RBAC |
| The indexer cluster forms but the dashboard shows no data | The managers still point at one indexer node, or the connector certificate was not redeployed. | cluster |
| The indexer stops accepting writes and the dashboard shows no recent data | The disk hit the flood-stage watermark and the cluster applied a read-only block, so ingest stopped. | system requirements |
| The snapshot does not appear on the destination cluster | The destination cluster reads its repositories at startup and has not been restarted. | upgrade and retention |
| Version mismatch | The manager and dashboard are on different major or minor versions after a partial upgrade. | dashboard tour |
Detection content (decoders, rules, API)
| Error or symptom | Likely cause | Fix |
|---|---|---|
| A 200 response that did not do what you asked | A bulk operation reported per-item failures inside a successful response. | API with Python |
| A community Sigma rule is imported and never fires | Community Sigma field names follow the author’s schema, not the Wazuh Common Schema. | Wazuh compared |
| A PCI DSS requirement number will not save in the rule | Unquoted YAML: a bare requirement number parses as something other than the string you wanted. | compliance |
| A ported rule’s counting logic silently disappeared | Frequency and timeframe have no equivalent in a 5.0 rule, and the rest of the rule stays valid. | Sigma rules and ATT&CK |
| A rule referenced by identifier stops matching after an update | The filter keyed on the Sigma identifier, which changes when the rule identifier changes. | false positives |
| A rule’s compliance mapping is missing from the finding | The mapping referenced an event field that was absent, which resolves to an empty string and is dropped. | compliance |
| Changes in Draft have no effect | Draft content is not evaluated. Only content promoted to Custom processes live events. | false positives |
| Changing a rule did not change existing findings | Documented behaviour: rule changes apply at the next evaluation and do not rewrite existing findings. | Sigma rules and ATT&CK |
| CTI content is out of date and nothing reported an error | A failed or stalled content synchronisation, which does not surface in the interface. | threat intelligence |
| Engine validation failed on create | A target field outside the Common Schema, a literal of the wrong type, or two adjacent logpar placeholders. | custom decoder |
| Events arrive but land in the unclassified stream | Only the root decoder accepted the event, so no integration claims that log format yet. | rules and decoders, log collection |
| Events reach the indexer with no decoded fields | No integration’s decoder claimed the event, so it landed unclassified with only the original message. | custom decoder |
| Indicators load but never match | The content is still in draft or test, the KVDB name does not match the title, or the key format differs. | threat intelligence |
| Resource creation limit reached | The Content Manager caps each resource type, 100 by default, and returns a 400 at the ceiling. | custom rules |
| Rule rejected with a structured error naming a field | The field named is not in the Wazuh Common Schema, and detection field names are validated at creation. | custom rules, rules and decoders, threat intelligence |
| Some blocklist entries never fire | CIDR entries in a KVDB. Keys are exact strings, so a prefix never equals an address. | threat intelligence |
| SSL verification failures against a fresh install | The installation assistant issues its own CA, which your HTTP client does not trust yet. | API with Python |
| The decoder builds but Log test shows only the root decoder | No root decoder is attached, the parent named is outside the policy, or a sibling claimed the event first. | custom decoder |
| The exclusion matches more than intended | An over-broad modifier, such as a contains on a short string. | false positives |
| The Regulatory Compliance dashboard is empty | No findings carry that framework key yet, or the time range excludes the ones that do. | compliance |
| The rule saves but never matches anything | The log source product does not equal the parent integration’s title, or the detector watches the wrong index. | Sigma rules and ATT&CK |
| The rule validates and promotes but no findings appear | Work backwards: the events, the detector’s rule selection, the space, the interval, the enabled flag. | custom rules, rules and decoders |
| The tuned rule is active but the noise continues | The original standard rule is still selected in the detector alongside your tuned copy. | false positives |
| Two findings per event after tuning | Both the original and the tuned copy are running, or more than one policy is active. | false positives |
| You cannot edit a standard rule | Standard space content is read-only by design. | rules and decoders |
Notifications and Active Response
| Error or symptom | Likely cause | Fix |
|---|---|---|
| A burst of matches produces far fewer webhooks than findings | The actionable alert ceiling per monitor execution, 50 by default. | SOAR |
| Active response fires on an agent you did not intend | The response location is set to all agents, or the agent joined a group the response is scoped to. | active response |
| Credentials in a monitor message | A token was pasted into the action template instead of the channel, where anyone with read access sees it. | SOAR |
| Nothing in the Responses tab after three days | Retention doing its job: the active responses index keeps three days by default. | VirusTotal and YARA |
| Notifications stop when you add more monitors | The documented per-user limit on custom monitors. | SOAR |
| The indexer cannot reach the webhook endpoint | The notifications host deny list, egress filtering or a connection timeout is blocking the call. | notifications |
| The monitor alerts but nothing is delivered | The destination names no live channel, the channel is muted, or the throttle suppressed the action. | notifications |
| The monitor exists but no request is ever written | The monitor is not an active response type, or its index, interval or trigger breaks a documented constraint. | active response, VirusTotal and YARA |
| The request is written but the script never runs | The executable is missing from the agent’s active response directory, or its permissions are wrong. | active response, VirusTotal and YARA |
| The script cannot find the file | The payload only carries a file path when the triggering finding had one. | VirusTotal and YARA |
| The script runs but nothing happens on the endpoint | The script reads a field the finding does not carry. | active response, VirusTotal and YARA |
| The stateful response never reverts | The disable branch is missing, throws, or depends on state that did not survive the timeout. | active response |
| The test message works but the monitor never notifies | The monitor query matches nothing, usually a wrong index category or severity string. | notifications |
| The webhook returns success but nothing appears in the destination | The payload does not match the format the receiving service expects. | notifications, SOAR |
Cloud, containers and modules
| Error or symptom | Likely cause | Fix |
|---|---|---|
| A command in agent.conf produces nothing and logs nothing | The remote command gate is not set on that endpoint, so distributed commands never execute. | log collection |
| A command rule never matches in a pushed policy | Remote commands are not enabled on the agent, so command rules in distributed policies do not run. | SCA and CIS benchmarks |
| A configured directory is never scanned | A realtime path that did not exist at agent start is ignored until the next restart. | file integrity monitoring |
| A custom policy produces no results at all | The policy’s requirements are not satisfied, so the scan for that file is skipped silently. | SCA and CIS benchmarks |
| A custom policy vanishes after an agent upgrade | Bundled ruleset directories are not preserved across installations and updates. | SCA and CIS benchmarks |
| A CVE you patched is still listed | The inventory has not refreshed yet; it updates after Syscollector reports the change. | vulnerability detection |
| A local FIM change has no effect | The group’s shared configuration overrides the local file for that directory. | file integrity monitoring |
| A network path generates nothing | UNC paths and mapped network drives are not supported on Windows, in any FIM mode. | file integrity monitoring |
| A Sysmon config change did not take effect | The install flag was used again instead of the reconfigure flag. | Sysmon |
A Windows <localfile> on a network path is ignored |
The Windows agent reads local file systems only, and ignores UNC paths and mapped drives silently. | log collection |
| Agents cannot enrol against the container | The agent points at the container name or at 1514 out of 4.x habit. | Docker deployment |
| Agents duplicate on every pod restart | The host path volume holding agent state is missing or does not survive the restart. | Docker and Kubernetes monitoring |
| An AWS bucket collects nothing on first run | The start date defaults to the day of execution, so existing history in the bucket is ignored. | cloud logs |
| Containers start but the manager cannot reach the indexer | Certificate common names do not match the hostnames in the compose file. | Docker deployment |
| Duplicate cloud events | Two agents run the same cloud module against the same source. | cloud logs |
| eBPF who-data behaves like audit mode | The provider fell back because the kernel is older than 5.8. | file integrity monitoring |
| Events are lost during a mass delete | The who-data queue overflowed and events beyond the queue size were dropped. | file integrity monitoring |
| Events arrive but no findings appear | The provider’s ruleset integration is disabled. | cloud logs |
| Events arrive but the rule never produces a finding | A field path the decoder does not set, or a value in the wrong form. | Sysmon |
| Events stop after a reboot or a Sysmon upgrade | Reinstalling Sysmon can reset the channel and drop the configuration. | Sysmon |
| Every check in a policy is Not applicable | The rule targets do not exist on that platform. | SCA and CIS benchmarks |
| Everything sits under “Under evaluation” | Entries still being assessed against available intelligence, which update when the data arrives. | vulnerability detection |
| Journald collection stopped after adding a filter | Once any journald block carries filters, journald blocks without filters are ignored. | log collection |
| Only some files under a wildcard are collected | The 1000-file ceiling across all blocks, or the age and exclude attributes on the block. | log collection |
| Port conflicts on start | Another service on the host holds one of the published ports, or the other stack is already running. | Docker deployment |
| Sysmon volume swamps the indexer after a fleet rollout | Event IDs 7 and 10 are the usual cause, and the cost is paid before a rule sees the event. | Sysmon |
| The agent is missing events written while it was stopped | Future-events collection is on by default, so the agent resumes at the end of the file. | log collection |
| The agent pod runs but never reaches Active | Work outwards from the pod: the agent log inside the container, then the default-deny network policies. | Docker and Kubernetes monitoring |
| The Azure module does nothing after a configuration change | A Python dependency outside Wazuh moved off the pinned version the module needs. | cloud logs |
| The Docker listener produces nothing | The Docker socket is unreachable, the pinned Python dependencies are wrong, or the integration is disabled. | Docker and Kubernetes monitoring |
| The GCP sink exists but the subscription stays empty | The sink’s writer identity has no publisher role on the topic. | cloud logs |
| The image cannot be pulled | On beta5 the image tags in the cloned compose file need the documented suffix. | Docker deployment |
| The indexer container restarts in a loop shortly after start | The host memory map limit is below 262144, and setting it inside the container does nothing. | Docker deployment |
| The inventory is empty for every endpoint | The manager-to-indexer path is broken, so the scanner cannot index results or fetch intelligence. | vulnerability detection |
| The inventory is empty for one endpoint | Syscollector is not collecting on that endpoint, or its results are not reaching the manager. | vulnerability detection |
| The listener starts and then stops | The module exhausted its retry attempts because the Docker daemon was not up when the agent started. | Docker and Kubernetes monitoring |
| The Sysmon channel exists but no events reach Wazuh | Work down the chain: the service, the channel record count, the agent restart, the channel name. | Sysmon |
| The whole policy stops loading after an edit | Duplicate check identifiers across policy files on that agent, or invalid YAML. | SCA and CIS benchmarks |
| Who-data produces no user information on Linux | An audit rule that halts processing of the rules that follow it. | file integrity monitoring |
You changed feed-update-interval and nothing got faster |
Values below 60 minutes are not supported and are ignored. | vulnerability detection |
| You tried to configure an offline feed | The offline feed option was removed in 5.0 and air-gapped feeds have no documented path in the beta. | vulnerability detection |
Next: Wazuh Glossary.
Frequently asked questions
Where are Wazuh logs?
The manager writes to /var/wazuh-manager/logs/wazuh-manager.log and the indexer to /var/log/wazuh-indexer/wazuh-indexer.log. A Linux agent writes to /var/ossec/logs/ossec.log, macOS to /Library/Ossec/logs/ossec.log, and the Windows agent to ossec.log in its installation folder. Active response has its own active-responses.log in the same agent log directory.
How do I read a Wazuh error?
Read the component first, then the message. Agent-side failures name the daemon, for example wazuh-agentd, while manager configuration failures carry a numeric code and a JSON pointer to the element that failed validation. Find the string on this page, confirm the cause in the linked lesson, then check the same event from the other side of the connection.
Why does the same error appear on 4.x and 5?
Several agent and enrolment messages were carried over unchanged, so the wording matches but the cause often does not. Paths, ports and configuration elements moved in 5.0, so a 4.x answer found in a search can point at a file that no longer exists. Every entry here is written against the 5.0 beta documentation and flags the 4.x difference where one exists.