Issue – High RAM usage on restart with custom rules Wazuh #33450
-
|
After adding many custom rules, wazuh-analysisd consumes all RAM during restart and is killed by the OOM killer, even though my VPS has 30GB of RAM and large swap. Is this a known issue with large/complex custom rules or regex? Any optimization tips? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
The error might be related to this issue, where rules with the same group and if_group cause a significant increase in memory usage, leading to OOM errors. The error may be related to these types of rules, which cause memory usage to increase significantly. Therefore, it would be beneficial to identify and disable them to determine if this is the cause or if it could be something else. |
Beta Was this translation helpful? Give feedback.
-
|
I’ve verified the issue, and it’s confirmed. The problem was caused by rules with the same group and if_group, which created a kind of infinite loop during rule processing, significantly increasing memory usage and leading to OOM errors. I’ve fixed it by adjusting these rules. |
Beta Was this translation helpful? Give feedback.
The error might be related to this issue, where rules with the same group and if_group cause a significant increase in memory usage, leading to OOM errors.
The error may be related to these types of rules, which cause memory usage to increase significantly. Therefore, it would be beneficial to identify and disable them to determine if this is the cause or if it could be something else.