Empty rules files may lead to a broken manager

[BraulioV]

Wazuh	Elastic	Rev
4.1.0	7.10.0	4101-1

Description
At the moment, a manager doesn't allow an empty local_rules.xml file. Analysisd can't read it and report a configuration error if it is empty.

If a user deletes the content of the local_rules.xml file and saves it, the app updates the file but it doesn't restart the manager and shows a "warning/error" message:

IMO, the app shouldn't allow this behavior. It already checks if there're errors in the configuration file and it prevents saving it so it should check if the file is empty or not too. If someone else deletes the content and save it, the next time it tries to restart the manager it will fail.

Steps to reproduce

1. Go to Management > Rules > Custom rules > local_rules.xml.
2. Delete the content of the file.
3. Save it.

[davidfmiranda]

Hello @BraulioV. This behavior also happens when creating a new rules file.

Regards,

David

[sortiz1191]

Check the error and find it in the code.

[sortiz1191]

Saving current file content for restore if validation fails.

[sortiz1191]

Edit file. Check for invalid file content:

• If the file is invalid, restore previous content and save the file again.

[sortiz1191]

Check if the file is new or is editing.