Pushing the shared custom folder into the agent host does not work correctly, If the agent belongs more than one group.

[Amblikmees]

Wazuh version	Component	Install type	Install method	Platform
4.1.5-1	Centralized configuration	Manager	Packages - All in one	CentOS 7.9.2009

Agent host:
Wazuh-agent: 4.1.5-1
OS: CentOS 7.9.2009

I tried to share/push Yara rules (a folder that contains yara rules) from manager to the agent, which belongs to the default group by using /var/ossec/etc/shared/default folder for that. Everything worked well until I added the same agent to another group(Created one separate group for Linux hosts as well). After that, the shared yara rules folder became an empty file in the agent's machine.

Before( Agent belongs to the default group):

After( Agent belongs to the default and Linux group):

If i remove the agent from second group and restart Wazuh agent, then the empty file returns to the folder with its contents.

[pereyra-m]

Hello @Amblikmees !

Sorry to hear you are experiencing this issue.

I was able to confirm that it's possible to share a whole folder only if the agent belongs to one group. When you add the second one, then the folders become empty.

The only workaround I can suggest right now, it's to share the files outside the folder.

The team will check this as soon as possible.
Regards.

[Amblikmees]

Hello @pereyra-m !
Thanks for the quick reply and hopefully Wazuh team will be able to fix it.
Until then, I'll be patient and wait for your feedback.

[Amblikmees]

Hello, any updates ?

[pereyra-m]

Hello !

I'm afraid I have no updates about this.
There is also a related issue #10181, we'll work on this as soon as possible.

Regards.