Inversal functionality of maxsize in rules.

[SalvaMilenario]

Wazuh version	Component	Install type	Install method	Platform
3.10.2	analysisd	Manager	Packages/Sources	linux

I configured new rules and I detected that the field maxsize it hasn't the functionality defined in the documentation.

In actuality, when the size of the event is less than maxsize this isn't sent, but if it's bigger, it sends. This isn't how it should work, the correct functionality should be that the size of this has been less than maxsize.

The issue is in this line:

wazuh/src/analysisd/analysisd.c

Lines 1191 to 1195 in ee0943d

	if (rule->maxsize) {
	if (lf->size < rule->maxsize) {
	return (NULL);
	}
	}

The proposed solution is a change of the symbol "<" by ">"

Regards