iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Wazuh can lose events at the agent, the manager’s remoted queue, or the manager’s analysisd decoder queues. The documented flooding alert applies to the agent-side queue; manager-side loss is diagnosed through dropped or discarded counters, queue statistics, and state files. That distinction matters: a missing security alert does not prove an event was received or processed.
Why a missing alert does not prove an event was processed
Wazuh Logcollector gathers endpoint, application, and network-device logs. The manager analyzes messages with decoders and rules; a message that matches an applicable rule can generate an alert. Separately, Wazuh can record collected logs in archives, including events that do not trigger alerts, if archive logging is configured and the event makes it through the pipeline. Wazuh’s log-data collection overview and event logging guide describe those different outputs.
There are therefore three different questions: did the agent collect the event, did the manager receive it, and did it reach rule matching? An event may be lost before rule matching, so it cannot produce a normal alert for that message. Wazuh’s analysisd documentation states: “If the selected queue is full, the event is dropped.” An absent alert is not, by itself, evidence of successful ingestion.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Three places events can be lost under load
| Stage | What is under pressure | Documented evidence | Where to investigate |
|---|---|---|---|
| Agent | The queue_ad leaky-bucket queue smooths bursts before sending events. |
A flooding alert when the documented bucket threshold is reached; Wazuh says subsequent events are dropped when the bucket fills. | Agent flooding/congestion indicators and collection-rate settings. |
Manager remoted |
queue_rd handles agent communications; manager-side queue pressure can discard messages. |
wazuh-remoted.state includes queue and discarded-message counters; API statistics are also available. |
/var/ossec/var/run/wazuh-remoted.state and manager queue statistics. |
Manager analysisd |
queue_and feeds analysis, including event-type decoder queues. |
wazuh-analysisd.state reports dropped events and queue usage; API statistics can help identify pressure. |
/var/ossec/var/run/wazuh-analysisd.state and analysis queue statistics. |
The agent flooding alert is the documented alert signal in this comparison. Wazuh’s cited manager guidance describes operational evidence such as counters, state files, and API metrics instead. This does not establish that no other alert rule, monitoring system, or integration could ever notify an operator about manager-side drops.
#1 Best Overall
- WIFI ENABLED TO CONTROL FROM ANYWHERE – Transform your home into a smart home with the Feit Electric Smart Wi-Fi Plug. Remotely turn on or off lights, fans, coffee makers, or other home appliances from your smartphone or tablet. Works seamlessly with Alexa and Google Home, giving you effortless voice control without needing a separate hub. Manage your devices anytime, whether you’re at home, at work, or traveling.
- SIMPLE SETUP, NO HUB REQUIRED – Enjoy the convenience of smart home automation without extra equipment. The plug connects directly to your 2.4 GHz Wi-Fi network, making installation fast and easy. Plug it in, download the Feit Electric app, follow the simple steps, and your devices are instantly connected. Perfect for beginners or anyone looking to expand their smart home ecosystem with minimal hassle.
- SET YOUR ROUTINE & SAVE ENERGY – Save energy, stay organized, and automate daily routines with customizable schedules and timers. Set your lamps, heaters, or appliances to turn on and off automatically at specific times, ensuring your home is always comfortable and efficient. Ideal for morning routines, evening wind-downs, or holiday lighting, giving you peace of mind and energy savings without constant manual operation.
- ENHANCED SAFETY & CONVENIENCE – Protect your home and appliances with the Feit Electric Smart Plug’s durable design and safety features. Its compact size fits easily into standard indoor outlets without blocking other sockets. With real-time app control and notifications, you can monitor appliance activity and prevent energy waste. Ideal for families, pet owners, or anyone seeking a smarter, safer, and more convenient home setup.
- RELIABLE 2.4GHz WI-FI PERFORMANCE – Designed to work exclusively on 2.4 GHz networks, this smart plug provides stable connectivity for smooth operation of all your devices. Avoid interruptions caused by incompatible networks, ensuring your appliances respond instantly when controlled via the app or voice commands. Perfect for indoor home use, it supports up to 15 amps, handling heavy-duty appliances safely and reliably.
How to diagnose the stage that is dropping events
- Clarify what is missing. Determine whether you cannot find a security alert, an expected archived log, or evidence that a queue dropped or discarded an event. Alerts and archives answer different questions; archive checks are useful only if archive logging is enabled and the event reached that point in the pipeline.
- Check the agent first. Look for the documented flooding alert and other agent-side congestion indications. Review whether the event burst is avoidable and whether collection is generating unnecessary volume. Wazuh documents rate-related controls for modules such as Logcollector and Syscollector; its agent queue guidance cautions that internal rate settings are advanced options and should be changed carefully.
- Inspect manager remoted statistics. Read
/var/ossec/var/run/wazuh-remoted.statefor fields includingqueue_size,total_queue_size,evt_count, anddiscarded_count. The state file updates every five seconds by default, so compare samples over time instead of treating one snapshot as a trend. The remoted state-file reference documents the fields; the queueing mechanisms guide also describes API-based monitoring. - Inspect manager analysis statistics. Read
/var/ossec/var/run/wazuh-analysisd.stateforevents_dropped, per-type queue usage, event counts, and alerts written. This file also updates every five seconds by default. Identify which event-type queue is filling rather than assuming all analysis queues need larger limits. See the analysisd state-file reference. - For Wazuh Cloud, compare drops with ingestion capacity. The Cloud environment page provides “Events – Dropped over time” and “Events – Processed vs dropped” metrics. Wazuh attributes drops to event rates exceeding configured average or peak EPS limits and recommends reviewing EPS, agent configuration, noisy events, and burst smoothing. See Monitor usage – Your environment.
What to tune after identifying the bottleneck
If the agent queue is filling
Reduce avoidable event volume where possible, review noisy inputs, and consider whether bursts can be smoothed. Evaluate the relevant module rate controls and leaky-bucket settings against the workload. These settings affect production and delivery at the agent, so make targeted changes and verify that the resulting collection remains appropriate.
If manager remoted is discarding messages
Use the observed queue and discarded counters to confirm remoted is the constrained stage. Wazuh documents the <remote> queue_size setting and the remoted.worker_pool control as possible tuning points. The current queue guide lists a worker-pool default of 4 and permits values from 1 to 16; these are configuration limits, not universal performance recommendations. Change only after observing the bottleneck, then recheck the counters. Configuration changes may require a manager restart, as described in the queue guide.
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
If an analysisd decoder queue is dropping events
Use the state-file queue usage and dropped-event data to identify the affected event type. Wazuh documents that analysisd queue sizes and worker configuration can be adjusted. Its state-file example shows many queue sizes of 16,384, but that example is not a sizing recommendation for every deployment: suitable capacity depends on event rates, event mix, and processing capacity. Tune the queue showing loss rather than increasing every queue indiscriminately.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIf Wazuh Cloud reports drops
Compare the observed workload with the configured average and peak EPS limits, then review noisy agent inputs and burst behavior. Frequent drops can reduce visibility because important events may be among those lost; the Cloud usage metrics help establish whether the problem aligns with configured ingestion capacity.
Rank #3
- Shelly Plus 1 PM is a Wi-Fi smart relay switch with 1 channel, up to 16A with power metering that can be used also as a WiFi repeater and Bluetooth gateway. Shelly Plus 1PM can be used to monitor the consumption and take control of home appliances, electric circuits, and office equipment individually.
- Automate electrical appliance and control - With Shelly Plus 1PM you can automate any electrical appliance in your home and control it remotely. Shelly Plus 1PM can control appliances with a large load which makes it perfect for kitchen appliances and domestic systems monitoring and control. You can get precise measurements of the power consumption of each appliance and switch in on/off remotely, no matter where you are.
- Set and be prepared for everything - Reveal the full potential of Shelly Plus 1PM by combining it with other devices from your home network! Set Shelly Plus 1PM to activate custom scenes based on hour, light, or various occurrences. For example, you can set Shelly Door/Window sensor to report a porch door opening and activate Shelly Plus 1PM to turn on the hot tub heaters only in the hours after 8 pm.
- Shelly Customer Service - Shelly is one of the fastest-growing Smart Home brands in the world with devices, providing solutions for the automation of private homes, buildings and businesses. We provide our customers with professional support and a 3 years device warranty.
- Shelly Smart Control App will help you control your Shelly devices remotely and will send notifications for all automated events in your home. You can easily configure devices and manage their settings individually, or you can create personalized scenes by combining Shelly devices to trigger certain actions in your home automation.
Verify that a change addressed the loss
After a targeted configuration or volume change, compare the relevant counters and queue usage across multiple samples. Confirm that dropped or discarded counts are no longer increasing under the workload that previously caused pressure, and check the appropriate downstream evidence: archives for collected, non-alerting logs when enabled, and alerts for messages that match rules. A quiet alert stream alone cannot establish that ingestion is healthy.
Quick Recap
Rank #4
- Portable 100M/1G Network TAP Appliance for remote capture of data traffic
- Integrated with a Raspberry Pi 4 module (8GB RAM and 64GB Micro SD Card)
- Can be used as a standalone 100M/1G network TAP with the external monitor port
- Dual DC power inputs for enhancing overall system availability
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
