{
  "id": 9925908,
  "title": "Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides",
  "url": "https://urgent.news/2026/09/26/wazuh-custom-rule-never-fires-and-analysisd-t-still-exits-0-the-file",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-26T06:21:21.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/xuxu298/wazuh-custom-rule-never-fires-and-analysisd-t-still-exits-0-the-file-name-decides-58od"
  },
  "original_language": "en",
  "account": "Wazuh rules are not loaded in alphabetical order in the /etc/rules directory. Instead, they are merged with the stock ruleset and loaded based on the full file name. If a custom rule's name sorts before the parent rule's file name, the custom rule will not be loaded, even if the config check exits with 0. The fix is to rename the custom rule's file so that it sorts after the parent rule's file name, either by adding a prefix, starting with a letter, or placing it in the local_rules.xml file. The manager log should be checked for any warnings related to the missing rule after a restart.",
  "summary": "You write a child rule for a stock Wazuh rule, drop it into /var/ossec/etc/rules/ , and run the config check. wazuh-analysisd -t exits 0. You restart the manager. The rule never fires, and wazuh-logtest shows the event landing on the parent instead. One common cause has nothing to do with the rule itself. It is the name of the file you put it in. What we measured On a throwaway…",
  "key_points": [
    "Wazuh rules loaded based on file name, not alphabetical order",
    "Custom rule may not fire if file name sorts before parent rule",
    "Fix by renaming custom rule file to sort after parent rule"
  ],
  "editors_take": "Custom Wazuh rules may not load as expected due to file name sorting, requiring a strategic naming approach to ensure proper loading and functionality.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}