Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides
You write a child rule for a stock Wazuh rule, drop it into /var/ossec/etc/rules/ , and run the config check. wazuh-analysisd -t exits 0. You restart the manager. The rule never fires, and wazuh-logtest shows the event landing on the parent instead. One common cause has nothing to do with the rule itself. It is the name of the file you put it in. What we measured On a throwaway…
Wazuh rules are not loaded in alphabetical order in the /etc/rules directory. Instead, they are merged with the stock ruleset and loaded based on the full file name. If a custom rule's name sorts before the parent rule's file name, the custom rule will not be loaded, even if the config check exits with 0. The fix is to rename the custom rule's file so that it sorts after the parent rule's file name, either by adding a prefix, starting with a letter, or placing it in the local_rules.xml file. The manager log should be checked for any warnings related to the missing rule after a restart.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
