wazuh-analysisd shows at most 50 load warnings. The rest of your ignored rules are silent.
If you load a large set of custom Wazuh rules, wazuh-analysisd -t and ossec.log can tell you that some of them will be ignored. What they don't tell you is that they stop counting at 50 messages. On Wazuh 4.14.7, anything beyond that is dropped, oldest first, with no line anywhere. We measured it, found where it comes from in the source, and checked a public community ruleset. The measurement One…
Wazuh-analysisd, a component of the Wazuh intrusion detection system, has a limit of 50 load warnings for custom rules. When more than 50 rules are loaded that cannot be found or have an invalid parent rule, the rest are silently dropped, with no indication given. This behavior was observed in Wazuh version 4.14.7 and was confirmed by measuring the number of warnings produced when testing 60 custom rules with missing IDs.
The first 50 rules generated two warning messages each, while the remaining 10 rules did not produce any warnings. However, the ignored rules still created 120 total warning messages. To avoid this issue, it is recommended to test custom rules in small batches using the wazuh-analysisd -t command, and to use a pre-checking tool that can identify potential issues before running the rules against live events.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
