Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect file ignoring due to modification time on windows #576

Open
Rebits opened this issue Feb 6, 2025 · 0 comments
Open

Incorrect file ignoring due to modification time on windows #576

Rebits opened this issue Feb 6, 2025 · 0 comments
Labels
level/task Task issue type/bug Bug issue

Comments

@Rebits
Copy link
Member

Rebits commented Feb 6, 2025

Wazuh version Component Install type Install method Platform
4.10.1 Logcollector Agent Packages Windows 10

Description

The logcollector module is not gathering modification time correctly in Windows affecting the age option, ignoring incorrectly not expected files

Environment

  • Agent configuration
  <localfile>
    <location>C:\Users\vagrant\u_ex250206_x.log</location>
    <log_format>iis</log_format>
	<age>1d</age>
  </localfile>
  • Wazuh Agent and server version 4.10.1

How to replicate

  • Include the localfile configuration block in a Windows agent configuration
  • Enable debug in the local internal options (windows.debug=1)
  • Create the C:\Users\vagrant\u_ex250206_x.log file and include some text.
  • Check modification time manually:
C:\Users\vagrant>dir /T:W  u_ex250206_x.log

02/06/2025  10:35 AM             1,538 u_ex250206_x.log
               1 File(s)          1,538 bytes
               0 Dir(s)  116,448,886,784 bytes free
  • Restart the wazuh agent
  • Include a new line in the C:\Users\vagrant\u_ex250206_x.log file
  • Check that events are not collected
  • Check that the file is being ignored:
2025/02/06 10:36:15 wazuh-agent[2648] logcollector.c:2194 at w_input_thread(): DEBUG: Ignoring file 'C:\Users\vagrant\u_ex250206_x.log' due to modification time

Evidences

Agent logs: ossec.log

@Rebits Rebits added level/task Task issue type/bug Bug issue labels Feb 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue type/bug Bug issue
Projects
None yet
Development

No branches or pull requests

1 participant