search

wazuh / wazuh-docker

Wazuh - Docker containers
https://wazuh.com
Other
613 stars 340 forks source link

Syslog events ingesting issue #1362

Closed Zendorea closed 1 month ago

Zendorea commented 1 month ago

I am having issues with ingesting remote syslog data.

Below are my verifications to the Wazuh environment but im still unable to see any ingress on the "/var/ossec/logs/archives/archives.json" File.

This is a Fresh install on an Ubuntu 22.04 OS following the Wazuh install instructions.

I have read this Issue but no root-cause or remediation steps were shared: https://github.com/wazuh/wazuh/issues/14443

image

image

image

image

image

Palo Alto is the Source for Syslog- image

Zendorea commented 1 month ago

Removed the field from the for syslog and restart manager: Watch the video

If you would like to build an Archive index for tshooting while is set to yes, follow this link to a video: Watch the video