Skip to content

Review agent info logs - #36234

Merged
jotacarma90 merged 1 commit into
mainfrom
enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages
May 25, 2026
Merged

Review agent info logs#36234
jotacarma90 merged 1 commit into
mainfrom
enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages

Conversation

@Antoniogm03

@Antoniogm03 Antoniogm03 commented May 20, 2026 •
edited by jotacarma90
Loading

Copy link
Copy Markdown
Member

Description

The goal of this PR is to review the agent logs and determine which logs should be uploaded to minfo and which ones should be retained.

Proposed Changes

We propose uploading the following logs to minfo:

  • From the start_agent.c file, upload the log entry “Trying to connect to server”
  • From the logcollector.c file, upload the module's startup log
  • From the fim_scan.c file, upload the log for FIM_FREQUENCY_STARTED
  • From the run_check.c file, upload the log entries for FIM_DAEMON_STARTED and FIM_FREQUENCY_TIME
  • From the wm_agent_info.c file, upload the startup log for the module and the library loading log
  • From the wm_sca.c file, upload the module's start, enable, and disable logs
  • From the wm_syscollector.c file, upload the module's startup log.

It is proposed to send the following logs to mdebug1:

  • From the agent_info_impl.cpp file, download the pause and triggering log for the module
  • From the sca_impl.cpp file, download the module's run log, the logs for the enabled, initialized, and starting modules.

The logs have been standardized so that the startup and shutdown logs have the same structure, and a duplicate “Start” log from the agent-info module has been removed.

Results and Evidence

  • Manager:
2026/05/25 08:12:05 wazuh-manager-authd: INFO: Started (pid: 140094).
2026/05/25 08:12:05 wazuh-manager-db: INFO: Started (pid: 140103).
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Store initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Content Manager initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: KVDB initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: IOC initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: GEO initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Fast metrics initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Schema initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: HLP initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Scheduler initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd (indexer-connector): WARNING: No username and password found in the keystore, using default values.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Indexer Connector initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Stream logger initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Builder initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Content Manager CRUD Service initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Raw Event Indexer initialized (index: wazuh-events-raw-v5).
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Orchestrator initialized and started with event queue size: 131072, events per second: unlimited.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Content Manager Sync Service initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: IOC Sync Service initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Dumper Events initialized.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Remote engine's server initialized and started.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Engine started and ready to process events.
2026/05/25 08:12:05 wazuh-manager-analysisd: INFO: Scheduler started.
2026/05/25 08:12:06 wazuh-manager-remoted: INFO: Started (pid: 140356). Listening on port 1514/TCP (secure).
2026/05/25 08:12:06 wazuh-manager-monitord: INFO: Started (pid: 140386).
2026/05/25 08:12:06 wazuh-manager-modulesd: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:control: INFO: Starting control thread.
2026/05/25 08:12:06 wazuh-manager-modulesd:router: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:inventory-sync: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:content_manager: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:database: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:agent-upgrade: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:vulnerability-scanner: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:task-manager: INFO: Started (pid: 140392).
2026/05/25 08:12:06 wazuh-manager-modulesd:vulnerability-scanner (indexer-connector): WARNING: No username and password found in the keystore, using default values.
2026/05/25 08:12:06 wazuh-manager-modulesd:content-updater: INFO: IndexerDownloader: Consumer 'cti:catalog:consumer:vulnerabilities' in index '.wazuh-cti-consumers' is idle. Starting feed download.
2026/05/25 08:12:06 wazuh-manager-modulesd:content-updater: INFO: IndexerDownloader: Starting incremental update from offset 420064
2026/05/25 08:12:06 wazuh-manager-modulesd:content-updater: INFO: IndexerDownloader: Incremental update download phase complete — 0 documents, new cursor: '420064'
2026/05/25 08:12:06 wazuh-manager-modulesd:vulnerability-scanner: INFO: Feed update process completed (changed=false).
2026/05/25 08:12:06 wazuh-manager-modulesd:vulnerability-scanner: INFO: CVE feed fully loaded — per-agent scans unblocked.
2026/05/25 08:12:16 wazuh-manager-monitord: INFO: wazuh: Manager started.
  • Agent:
2026/05/25 08:13:57 wazuh-execd: INFO: Started (pid: 142027).
2026/05/25 08:13:57 wazuh-agentd: INFO: Started (pid: 142035).
2026/05/25 08:13:57 wazuh-agentd: INFO: Trying to connect to server ([192.168.72.166]:1514/tcp).
2026/05/25 08:13:57 wazuh-agentd: INFO: (4102): Connected to the server ([192.168.72.166]:1514/tcp).
2026/05/25 08:13:58 wazuh-rootcheck: INFO: Started (pid: 142048).
2026/05/25 08:13:58 wazuh-syscheckd: INFO: Started (pid: 142050).
2026/05/25 08:13:58 wazuh-logcollector: INFO: Started (pid: 142058).
2026/05/25 08:13:58 wazuh-logcollector: INFO: Startup completed. Runtime-discovered files will be read from beginning.
2026/05/25 08:13:58 wazuh-modulesd: INFO: Started (pid: 142072).
2026/05/25 08:13:58 wazuh-modulesd:control: INFO: Starting control thread.
2026/05/25 08:13:58 wazuh-modulesd:agent-upgrade: INFO: Started (pid: 142072).
2026/05/25 08:13:58 wazuh-modulesd:agent-info: INFO: Started (pid: 142072).
2026/05/25 08:13:58 wazuh-modulesd:sca: INFO: Started (pid: 142072).
2026/05/25 08:13:58 wazuh-modulesd:syscollector: INFO: Started (pid: 142072).
2026/05/25 08:13:58 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2026/05/25 08:13:58 wazuh-syscheckd: INFO: (6000): Starting daemon...
2026/05/25 08:13:58 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2026/05/25 08:13:58 wazuh-syscheckd: INFO: (6008): File integrity monitoring scan started.
2026/05/25 08:13:58 wazuh-rootcheck: INFO: Starting rootcheck scan.
2026/05/25 08:13:58 wazuh-modulesd:sca: INFO: Scan started.
2026/05/25 08:13:59 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2026/05/25 08:14:00 wazuh-modulesd:sca: INFO: Scan ended.
2026/05/25 08:14:00 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.

Review Checklist

  • Code changes reviewed
  • Relevant evidence provided
  • Tests cover the new functionality
  • Configuration changes documented
  • Developer documentation reflects the changes
  • Meets requirements and/or definition of done
  • No unresolved dependencies with other issues

@Antoniogm03 Antoniogm03 linked an issue May 20, 2026 that may be closed by this pull request
Review agent INFO logs moved to Debug and silence redundant messages #36112
Closed
@Antoniogm03
Antoniogm03 marked this pull request as draft May 20, 2026 09:26
@Antoniogm03
Antoniogm03 force-pushed the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch from b9f94bc to 43c4d75 Compare May 20, 2026 11:51
@Antoniogm03 Antoniogm03 self-assigned this May 20, 2026
@Antoniogm03
Antoniogm03 force-pushed the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch 3 times, most recently from b5ae0e8 to b44b16c Compare May 21, 2026 11:35
jotacarma90
jotacarma90 requested changes May 21, 2026
View reviewed changes

@jotacarma90 jotacarma90 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • sca: 6 lines at startup today. Keep only Started (pid: X), Scan started. and Scan ended.. The rest (Module enabled., SCA initialized., Starting module., Module scan on start.) to DEBUG.

  • syscollector: Module enabled. and Starting module. to DEBUG. Module started. becomes Started (pid: X).

  • agent-info: Module enabled., Successfully loaded agent-info library and AgentInfo initialized. to DEBUG. Should emit a single Started (pid: X) line.

  • agent-upgrade: change Module started. to Started (pid: X).

  • content_manager, inventory_sync, router, vulnerability_scanner: Module enabled. to DEBUG. They should emit Started (pid: X) at startup. The Module finished. line at shutdown can stay at INFO.

@Antoniogm03
Antoniogm03 force-pushed the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch 2 times, most recently from 9d12718 to 9f34178 Compare May 22, 2026 09:04
@Antoniogm03
Antoniogm03 marked this pull request as ready for review May 22, 2026 09:06
@jotacarma90
jotacarma90 force-pushed the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch 2 times, most recently from 254b5ad to 04c06c2 Compare May 22, 2026 17:04
@jotacarma90 jotacarma90 mentioned this pull request May 22, 2026
Merged
@jotacarma90
jotacarma90 force-pushed the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch from 04c06c2 to 9354f75 Compare May 22, 2026 17:47
jotacarma90 added a commit to wazuh/qa-integration-framework that referenced this pull request May 24, 2026
@jotacarma90
fix: update syscollector log patterns after agent log review
58f8ac0 
Align syscollector module patterns with the new log messages introduced
in wazuh/wazuh#36234:

- CB_MODULE_STARTING: "Starting Syscollector." -> "Starting module."
- CB_MODULE_STARTED: "INFO: Module started." -> "INFO: Started (pid: N)."
  (the explicit "Module started." log was removed; STARTUP_MSG is emitted
  instead).
- CB_SYSCOLLECTOR_DISABLED: "Module disabled. Exiting..." (three dots)
  -> "Module disabled. Exiting." (single period, matches new wording).
@jotacarma90
jotacarma90 force-pushed the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch from 9354f75 to 72174b8 Compare May 24, 2026 15:46
@jotacarma90
jotacarma90 force-pushed the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch from 72174b8 to c2373cd Compare May 24, 2026 18:57
@jotacarma90
jotacarma90 requested review from a team as code owners May 24, 2026 18:57
jotacarma90
jotacarma90 approved these changes May 25, 2026
View reviewed changes

@jotacarma90 jotacarma90 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jotacarma90
jotacarma90 merged commit 55ff1d4 into main May 25, 2026
72 checks passed
@jotacarma90
jotacarma90 deleted the enhancement/36112-review-agent-info-logs-moved-to-debug-and-silence-redundant-messages branch May 25, 2026 08:25
This was referenced May 26, 2026
Merged
Closed
pull Bot pushed a commit to kp-forks/wazuh that referenced this pull request May 27, 2026
@jr0me
fix(syscollector): bump CB_SCAN_STARTED timeout and trigger ITs on wm…
394ee61 
…_syscollector.c

PR wazuh#36234 moved syscollector's startup INFO log from `Syscollector::syncLoop()`
(post-DataClean) to `wm_sys_main()` (pre-DataClean) without bumping the test's
`CB_SCAN_STARTED` timeout. In `test_syscollector_collectors_disabled` the
post-DataClean window stayed at 10s, but the gap now includes the full
`handleNotifyDataClean` retry budget (`m_dataCleanRetries` × 60s — typically
3 × 60s) because the test env's remoted_simulator does not ack DataClean.
Three parametrized cases (packages_disabled, packages_processes_disabled,
network_disabled) consequently fail on every Linux/Windows IT run.

This was not caught when wazuh#36234 landed because the syscollector IT path
triggers in `.github/test_modules_linux.json` and `.github/test-modules-windows.json`
only listed `src/wazuh_modules/syscollector/**` and `src/config/src/wmodules-syscollector.c`;
PR wazuh#36234's change lives in `src/wazuh_modules/src/wm_syscollector.c`, so no
IT shard was selected on that PR.

- Bump the `CB_SCAN_STARTED` timeout to 240s and comment why.
- Add `src/wazuh_modules/src/wm_syscollector.c` to the syscollector IT trigger
  paths on Linux and Windows so future changes to the wm-side entry point
  run the IT.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jotacarma90 jotacarma90 jotacarma90 approved these changes

Assignees

@Antoniogm03 Antoniogm03

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Review agent INFO logs moved to Debug and silence redundant messages

2 participants

@Antoniogm03 @jotacarma90