Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Let Remoted check the agents' group when they deliver the keepalive #8974

Closed
3 tasks done
TomasTurina opened this issue Jun 11, 2021 · 0 comments · Fixed by #9088
Closed
3 tasks done

Let Remoted check the agents' group when they deliver the keepalive #8974

TomasTurina opened this issue Jun 11, 2021 · 0 comments · Fixed by #9088
Assignees
Labels
module/remote type/enhancement New feature or request

Comments

@TomasTurina
Copy link
Member

TomasTurina commented Jun 11, 2021

Wazuh version Component Install type Install method Platform
4.2.1 wazuh-remoted Manager Packages/Sources Linux

Description

When wazuh-remoted receives a keep-alive message from an agent, it processes it in two stages:

  • First, it receives the message, marks the agent as connected, updates the agent's status in the DB and queues the message to continue processing it later. This happens in function save_controlmsg.
  • Second, it unqueues the message, identifies the group to which the agent belongs, updates the DB and, if necessary, sends the new remote configuration. This happens in function read_controlmsg.

The problem with this is that, when a system is heavily loaded, it can take a long time to identify and save in the DB the group to which an agent belongs.

To avoid this, the logic that is in charge of guessing the group to which an agent belongs must be moved from stage two to stage one, in such a way that when an agent is in a connected state, it will always have some group assigned.

To do:

  • Update logic in Wazuh code.
  • Add UT for new functions.
  • Update documentation, if applies.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
module/remote type/enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants