v4.14.9
---
rc2

Identified Wazuh configuration files to mount...
'/wazuh-config-mount/etc/ossec.conf' -> '/var/ossec/etc/ossec.conf'

# 1. 编辑宿主侧配置（Compose 部署）或直接编辑 /var/ossec/etc/ossec.conf（系统包部署）
vim config/wazuh_cluster/wazuh_manager.conf

# 2. 重建 manager 使挂载文件重新拷贝生效
docker compose up -d --force-recreate wazuh.manager

# 3. 验证新配置已加载（以追加 syslog 接收段为例）
docker compose exec wazuh.manager grep -c "<connection>syslog" /var/ossec/etc/ossec.conf

1

2026/10/20 03:17:48 wazuh-remoted: INFO: Remote syslog allowed from: '10.89.60.0/24'
2026/10/20 03:17:48 wazuh-remoted: INFO: Started (pid: 704). Listening on port 514/UDP (syslog).

<global>
  <jsonout_output>yes</jsonout_output>
  <alerts_log>yes</alerts_log>
  <logall>no</logall>
  <logall_json>no</logall_json>
  <email_notification>no</email_notification>
  <smtp_server>smtp.example.wazuh.com</smtp_server>
  <email_from>wazuh@example.wazuh.com</email_from>
  <email_to>recipient@example.wazuh.com</email_to>
  <email_maxperhour>12</email_maxperhour>
  <email_log_source>alerts.log</email_log_source>
  <agents_disconnection_time>10m</agents_disconnection_time>
  <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
</global>

<alerts>
  <log_alert_level>3</log_alert_level>
  <email_alert_level>12</email_alert_level>
</alerts>

2026 Oct 20 03:30:20 (wazuh-agent-host) any->journald Oct 20 03:30:19 wazuh-agent-host kernel: workqueue: e1000_watchdog [e1000] hogged CPU for >10000us 16 times, consider switching to WQ_UNBOUND
2026 Oct 20 03:28:44 wazuh->rootcheck Ending rootcheck scan.

<remote>
  <connection>secure</connection>
  <port>1514</port>
  <protocol>tcp</protocol>
  <queue_size>131072</queue_size>
</remote>

<ossec_config>
  <remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>udp</protocol>
    <allowed-ips>10.89.60.0/24</allowed-ips>
  </remote>
</ossec_config>

2026/10/20 03:17:48 wazuh-remoted: INFO: Remote syslog allowed from: '10.89.60.0/24'
2026/10/20 03:17:48 wazuh-remoted: INFO: Started (pid: 704). Listening on port 514/UDP (syslog).
2026/10/20 03:17:48 wazuh-remoted: INFO: Started (pid: 703). Listening on port 1514/TCP (secure).

python3 -c "
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
msg = '<34>Oct 20 11:45:01 wazuh-agent-host sshd[20001]: Failed password for admin from 10.0.0.77 port 60001 ssh2'
s.sendto(msg.encode(), ('<manager地址>', 514))
print('sent')
"

sent

rule: 100002 level: 10 | Custom: SSH authentication failure detected for user. | location: 10.89.60.5

<syscheck>
  <disabled>no</disabled>
  <frequency>43200</frequency>
  <scan_on_start>yes</scan_on_start>
  <alert_new_files>yes</alert_new_files>
  <auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
  <directories>/etc,/usr/bin,/usr/sbin</directories>
  <directories>/bin,/sbin,/boot</directories>
  <ignore>/etc/mtab</ignore>
  <ignore type="sregex">.log$|.swp$</ignore>
  <nodiff>/etc/ssl/private.key</nodiff>
  <skip_nfs>yes</skip_nfs>
  <skip_dev>yes</skip_dev>
  <skip_proc>yes</skip_proc>
  <skip_sys>yes</skip_sys>
  <process_priority>10</process_priority>
  <max_eps>100</max_eps>
  <synchronization>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <max_interval>1h</max_interval>
    <max_eps>10</max_eps>
  </synchronization>
</syscheck>

Syscheck last started at:  Tue Oct 20 03:08:22 2026
Syscheck last ended at:    Tue Oct 20 03:08:23 2026

<rootcheck>
  <disabled>no</disabled>
  <check_files>yes</check_files>
  <check_trojans>yes</check_trojans>
  <check_dev>yes</check_dev>
  <check_sys>yes</check_sys>
  <check_pids>yes</check_pids>
  <check_ports>yes</check_ports>
  <check_if>yes</check_if>
  <frequency>43200</frequency>
  <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
  <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
  <skip_nfs>yes</skip_nfs>
</rootcheck>

<wodle name="syscollector">
  <disabled>no</disabled>
  <interval>1h</interval>
  <scan_on_start>yes</scan_on_start>
  <hardware>yes</hardware>
  <os>yes</os>
  <network>yes</network>
  <packages>yes</packages>
  <ports all="yes">yes</ports>
  <processes>yes</processes>
  <synchronization>
    <max_eps>10</max_eps>
  </synchronization>
</wodle>

<sca>
  <enabled>yes</enabled>
  <scan_on_start>yes</scan_on_start>
  <interval>12h</interval>
  <skip_nfs>yes</skip_nfs>
</sca>

"name": "CIS Ubuntu Linux 22.04 LTS Benchmark v2.0.0.",
"pass": 78, "fail": 80, "invalid": 49, "total_checks": 207, "score": 49

<vulnerability-detection>
  <enabled>yes</enabled>
  <index-status>yes</index-status>
  <feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>

2026/10/20 03:04:40 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started.

<indexer>
  <enabled>yes</enabled>
  <hosts>
    <host>https://wazuh.indexer:9200</host>
  </hosts>
  <ssl>
    <certificate_authorities>
      <ca>/etc/ssl/root-ca.pem</ca>
    </certificate_authorities>
    <certificate>/etc/ssl/filebeat.pem</certificate>
    <key>/etc/ssl/filebeat.key</key>
  </ssl>
</indexer>

<command>
  <name>firewall-drop</name>
  <executable>firewall-drop</executable>
  <timeout_allowed>yes</timeout_allowed>
</command>

<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5760</rules_id>
  <timeout>600</timeout>
</active-response>

<global>
  <white_list>127.0.0.1</white_list>
  <white_list>^localhost.localdomain$</white_list>
</global>

<localfile>
  <log_format>command</log_format>
  <command>df -P</command>
  <frequency>360</frequency>
</localfile>

<localfile>
  <log_format>full_command</log_format>
  <command>netstat -tulpn | sed ... | sort -k 4 -g | ...</command>
  <alias>netstat listening ports</alias>
  <frequency>360</frequency>
</localfile>

<localfile>
  <log_format>full_command</log_format>
  <command>last -n 20</command>
  <frequency>360</frequency>
</localfile>

<localfile>
  <log_format>journald</log_format>
  <location>journald</location>
</localfile>

<localfile>
  <log_format>syslog</log_format>
  <location>/var/ossec/logs/active-responses.log</location>
</localfile>

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/dpkg.log</location>
</localfile>

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/auth.log</location>
</localfile>

echo "Oct 20 11:25:01 wazuh-agent-host sshd[12346]: Failed password for admin from 10.0.0.99 port 51235 ssh2" >> /var/log/auth.log

"rule":{"level":5,"description":"sshd: authentication failed.","id":"5760",...}
"agent":{"id":"001","name":"wazuh-agent-host","ip":"10.89.60.5"}
"decoder":{"parent":"sshd","name":"sshd"}
"data":{"srcip":"10.0.0.99","srcport":"51235","dstuser":"admin"}
"location":"/var/log/auth.log"

ls /var/ossec/ruleset/rules/ | wc -l   -> 168
ls /var/ossec/ruleset/decoders/ | wc -l -> 120

<ruleset>
  <decoder_dir>ruleset/decoders</decoder_dir>
  <rule_dir>ruleset/rules</rule_dir>
  <rule_exclude>0215-policy_rules.xml</rule_exclude>
  <list>etc/lists/audit-keys</list>
  <list>etc/lists/amazon/aws-eventnames</list>
  <list>etc/lists/security-eventchannel</list>
  <list>etc/lists/malicious-ioc/malicious-ip</list>
  <list>etc/lists/malicious-ioc/malicious-domains</list>
  <list>etc/lists/malicious-ioc/malware-hashes</list>
  <decoder_dir>etc/decoders</decoder_dir>
  <rule_dir>etc/rules</rule_dir>
</ruleset>

audit-keys  audit-keys.cdb
security-eventchannel  security-eventchannel.cdb
malicious-ioc/malicious-domains  malicious-ioc/malicious-domains.cdb

<group name="local,syslog,sshd">

  <rule id="100002" level="10">
    <if_sid>5760</if_sid>
    <description>Custom: SSH authentication failure detected for user.</description>
  </rule>

</group>

**Phase 3: Completed filtering (rules).
        id: '100002'
        level: '10'
        description: 'Custom: SSH authentication failure detected for user.'

2026/10/20 03:11:53 wazuh-analysisd: WARNING: (7612): Rule ID '100001' is duplicated. Only the first occurrence will be considered.

<decoder name="myapp-decoder">
  <program_name>myapp</program_name>
</decoder>

<decoder name="myapp-status">
  <parent>myapp-decoder</parent>
  <regex>status=(\w+) user=(\w+)</regex>
  <order>status, user</order>
</decoder>

        program_name: 'myapp'
**Phase 2: Completed decoding.
        name: 'myapp-decoder'
        dstuser: 'alice'
        status: 'ok'

<auth>
  <disabled>no</disabled>
  <port>1515</port>
  <use_source_ip>no</use_source_ip>
  <purge>yes</purge>
  <use_password>no</use_password>
  <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
  <ssl_verify_host>no</ssl_verify_host>
  <ssl_manager_cert>etc/sslmanager.cert</ssl_manager_key>
  <ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
  <ssl_auto_negotiate>no</ssl_auto_negotiate>
</auth>

2026/10/20 03:06:18 wazuh-authd: INFO: Received request for a new agent (wazuh-agent-host) from: 10.89.60.5
2026/10/20 03:06:18 wazuh-authd: INFO: Agent key generated for 'wazuh-agent-host' (requested by any)

<cluster>
  <name>wazuh</name>
  <node_name>node01</node_name>
  <node_type>master</node_type>
  <key>aa093264ef885029653eea20dfcf51ae</key>
  <port>1516</port>
  <bind_addr>0.0.0.0</bind_addr>
  <nodes>
      <node>wazuh.manager</node>
  </nodes>
  <hidden>no</hidden>
  <disabled>yes</disabled>
</cluster>

ERROR: Cluster is not running.

<ossec_config>
  <client>
    <server>
      <address>wazuh.manager</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <config-profile>ubuntu, ubuntu22, ubuntu22.04</config-profile>
    <notify_time>10</notify_time>
    <time-reconnect>60</time-reconnect>
    <auto_restart>yes</auto_restart>
    <crypto_method>aes</crypto_method>
  </client>
</ossec_config>

<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>yes</alerts_log>
    <logall>no</logall>
    <logall_json>no</logall_json>
    <email_notification>yes</email_notification>
    <smtp_server>smtp.example.wazuh.com</smtp_server>
    <email_from>wazuh@example.wazuh.com</email_from>
    <email_to>soc@example.wazuh.com</email_to>
    <email_maxperhour>60</email_maxperhour>
    <email_log_source>alerts.log</email_log_source>
    <agents_disconnection_time>10m</agents_disconnection_time>
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
  </global>

  <alerts>
    <log_alert_level>3</log_alert_level>
    <email_alert_level>10</email_alert_level>
  </alerts>

  <remote>
    <connection>secure</connection>
    <port>1514</port>
    <protocol>tcp</protocol>
    <queue_size>131072</queue_size>
  </remote>

  <syscheck>
    <directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
    <max_eps>200</max_eps>
  </syscheck>
</ossec_config>