The file limit set for this agent is 100000. Now, 100000 files are being monitored and no more files will be monitored. Change this setting in centralized configuration or locally on the agent.

Description

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 200 Grouping of wazuh rules. anchor level 0
   decoded_as=wazuh
2. 230 FIM DB rule anchor level 0
   location=syscheck$ AND match="^wazuh: FIM DB:"
3. 233 The maximum limit of files monitored has been reached. At this moment there are files and the limit is . From this moment some events can be lost. You can modify this setting in the centralized configuration or locally in the agent. · alert_type = full, fim_db_table = file_entry anchor level 12
   field alert_type="full" AND field fim_db_table="file_entry"
4. 900053 The file limit set for this agent is 100000. Now, 100000 files are being monitored and no more files will be monitored. Change this setting in centralized configuration or locally on the agent. exclusion level 7 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 233
  • The maximum limit of files monitored has been reached. At this moment there are files and the limit is . From this moment some events can be lost. You can modify this setting in the centralized configuration or locally in the agent. · alert_type = full, fim_db_table = file_entry