What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A clean Wazuh configuration check confirms that the configuration passes that check; it does not prove that an event matches your custom rule or that a match becomes a live alert. Diagnose the gap with /var/ossec/bin/wazuh-logtest: check what the event decodes into, whether rule prerequisites and thresholds are met, and whether the match is suppressed or the manager is still using older rules.
What a clean check does—and does not—tell you
Wazuh processes events through pre-decoding, decoding, and rule matching. These are separate stages: an event can be valid input yet fail to produce the fields a rule expects, satisfy its conditions, or generate an alert. A successful configuration check therefore is not evidence that a particular event reaches a particular rule.
Use the exact raw event that should trigger the rule as the test input. Wazuh’s wazuh-logtest documentation describes testing sample logs against decoders and rules, while its custom rules guide explains how to test saved rule changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. The event decodes differently from what the rule expects
A custom rule can be syntactically sound but still fail if the event’s decoder does not extract the fields or values named in the rule. Wazuh’s command-output processing documentation states that logs with no matching decoder are ignored. See Command output analysis for the processing stages.
#1 Best Overall
- On the Wazuh server, run
/var/ossec/bin/wazuh-logtest. - Submit the raw event as received, rather than a shortened or reformatted version.
- Inspect the pre-decoding and decoding output. Confirm which decoder matched and which fields were extracted.
- Compare those actual field names and values with the conditions in your custom rule.
If an expected field is absent or has a different value, correct the event or rule to match the actual decoded data. Do not infer field availability from the configuration check.
2. A prerequisite or correlation threshold is not met
Rules can depend on earlier matches or other conditions. Wazuh’s rule syntax reference describes if_sid and if_group prerequisites. Correlation rules using if_matched_sid can also require a specified frequency within a timeframe; one event may not be enough.
- In logtest output, identify the rule IDs that matched for the event.
- Check every condition in the custom rule, including decoded fields and any required parent rule or group.
- For correlation rules, verify the configured frequency and timeframe against the events actually observed.
- Check the relevant parent rules as well as the custom rule: a dependent rule cannot match if its prerequisite did not.
A rule that passes configuration validation can still have unmet runtime conditions. The matched rule IDs and decoded fields show where the chain diverges.
Recommended Free Tools
3. The rule matches, but no alert is generated—or live rules are stale
Check alert level and suppression
A match is not necessarily an alert. Wazuh classifies level 0 rules as rules that do not generate alerts; the noalert setting can likewise suppress an alert while analysis continues. Check the rule’s level and suppression behavior in the rules classification documentation and syntax reference.
Apply edits to live alerting
Saved custom-rule changes can be tested with logtest, but the Wazuh manager must be restarted for live alert generation to use those changes. Keep custom rules in /var/ossec/etc/rules/; Wazuh warns that edits made directly in the packaged ruleset directory can be overwritten during upgrades. Follow the custom rules instructions for the testing and restart procedure.
Follow the alert downstream if logtest reports one
If processing indicates an alert but it does not appear in the dashboard, investigate delivery and indexing rather than changing the rule first. Wazuh’s dashboard troubleshooting guide recommends checking whether alert indices exist in the indexer and testing Filebeat output when they do not.
A practical diagnostic order
- Save one exact raw event that should trigger the rule.
- Run
/var/ossec/bin/wazuh-logteston the Wazuh server with that event; use verbose output if useful. - Check pre-decoding and decoded fields, then verify that the expected decoder matched.
- Compare the event’s fields and matched rule IDs with the custom rule, its parent conditions, and any frequency/timeframe requirements.
- If the rule matches but no alert is generated, inspect its level and
noalertbehavior. - If you edited the rule, restart the manager before expecting live alerts to use the change.
- If logtest indicates an alert but the dashboard has none, check alert indices in the indexer and Filebeat output.
What the 4.14.7 release notes establish
Wazuh’s 4.14.7 release notes are dated 29 July 2026. Their summary includes manager changes, dependency updates, dashboard sanitization, and ruleset fixes for SCA checks; it does not identify a custom-rule matching change. That release context does not establish that every detail in the current documentation paths above is identical to an archived 4.14.7 manual. For a disputed version-specific behavior, consult documentation archived for the relevant release.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
