{"id":5519,"date":"2026-09-26T04:01:16","date_gmt":"2026-09-26T07:01:16","guid":{"rendered":"https:\/\/tucumandevelopers.com\/index.php\/2026\/09\/26\/wazuh-custom-rule-never-fires-and-analysisd-t-still-exits-0-the-file-name-decides\/"},"modified":"2026-09-26T04:01:16","modified_gmt":"2026-09-26T07:01:16","slug":"wazuh-custom-rule-never-fires-and-analysisd-t-still-exits-0-the-file-name-decides","status":"publish","type":"post","link":"https:\/\/tucumandevelopers.com\/index.php\/2026\/09\/26\/wazuh-custom-rule-never-fires-and-analysisd-t-still-exits-0-the-file-name-decides\/","title":{"rendered":"Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides"},"content":{"rendered":"
\n
<\/div>\n

5715<\/code> lives in \/var\/ossec\/ruleset\/rules\/0095-sshd_rules.xml<\/code>. We put the same rule in five differently named files in \/var\/ossec\/etc\/rules\/<\/code>, ran wazuh-analysisd -t<\/code>, restarted, and sent one line through wazuh-logtest<\/code>: <\/p>\n

\n
Sep 26 10:00:00 host1 sshd[1234]: Accepted password for root from 203.0.113.5 port 22 ssh2 <\/span><\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
\n\n\n\n\n\n\n\n\n\n
file<\/th>\n -t<\/code> exit<\/th>\n7617 \/ 7619 warnings<\/th>\nlogtest lands on<\/th>\n<\/tr>\n<\/thead>\n
0094-test.xml<\/code><\/td>\n0<\/td>\nyes<\/td>\n 5715<\/code> (our rule ignored)<\/td>\n<\/tr>\n
0096-test.xml<\/code><\/td>\n0<\/td>\nno<\/td>\n 100080<\/code> (fires)<\/td>\n<\/tr>\n
local_rules.xml<\/code><\/td>\n0<\/td>\nno<\/td>\n 100080<\/code> (fires)<\/td>\n<\/tr>\n
0095-aaa.xml<\/code><\/td>\n0<\/td>\nyes<\/td>\n 5715<\/code> (our rule ignored)<\/td>\n<\/tr>\n
0095-zzz.xml<\/code><\/td>\n0<\/td>\nno<\/td>\n 100080<\/code> (fires)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
The two warnings, word for word: <\/p>\n
\n
WARNING: (7617): Signature ID '5715' was not found and will be ignored in the 'if_sid' option of rule '100080'. WARNING: (7619): Empty 'if_sid' value. Rule '100080' will be ignored. <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
  <\/a> What it means <\/h2>\n
Files in etc\/rules<\/code> are not loaded after the stock ruleset. They are merged with ruleset\/rules<\/code> and loaded in order of the full file name<\/strong>. The last two rows show it: 0095-aaa.xml<\/code> sorts before 0095-sshd_rules.xml<\/code>, so when our rule is read, 5715<\/code> does not exist yet and the rule is dropped. 0095-zzz.xml<\/code> sorts after it, and the same rule fires.<\/p>\n
local_rules.xml<\/code> is safe for this reason: letters sort after digits, and all 168 stock rule files in 4.14.7 start with a digit (0010<\/code> to 0999<\/code>), so it loads after every one of them.<\/p>\n
The trap is the config check. wazuh-analysisd -t<\/code> exits 0 in all five cases. It prints the two warnings, but a warning is not a failure, and nothing in a deploy script that checks the exit code will stop. The manager then starts cleanly with one rule fewer than you think.<\/p>\n
  <\/a> Check yours in a minute <\/h2>\n
After a restart, the warnings are also in the manager log: <\/p>\n
\n
grep<\/span> -E<\/span> '\\((7617|7619)\\)'<\/span> \/var\/ossec\/logs\/ossec.log <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
Every rule id you see in a 7619 line is a rule that is not running. The 7617 line on the same second tells you which parent it was waiting for.<\/p>\n
Before a restart, run the check yourself and read its output instead of trusting the exit code: <\/p>\n
\n
\/var\/ossec\/bin\/wazuh-analysisd -t<\/span> 2>&1 | grep<\/span> -E<\/span> '\\((7617|7619)\\)'<\/span> <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
For a single rule, wazuh-logtest<\/code> with a real sample line is the final word: if the output shows the parent’s id and not yours, your rule did not load or did not match.<\/p>\n
  <\/a> The fix <\/h2>\n
Move the child rule into a file whose name sorts after<\/strong> the file that holds its parent:<\/p>\n