Wazuh can lose events at the agent, at the manager’s remoted queue, or in analysisd before rule matching. The documented agent-side flooding condition raises an alert when its leaky bucket fills; manager-side loss is diagnosed through counters, queue statistics, and state files. So an absent security alert does not prove an event arrived and was processed—or that it was never collected.
Why missing alerts do not tell the whole story
Wazuh Logcollector collects endpoint, application, and network-device logs, which are then analyzed on the manager. When a message matches an applicable rule, Wazuh can write a security alert. Archives serve a different purpose: if archive logging is enabled, they can retain collected logs that did not trigger an alert. Thus, “not in alerts” and “never received” are different questions. An event must also survive the pipeline to be archived.
As an Amazon Associate I earn from qualifying purchases.
On the manager, analysisd routes messages to event-type decoder queues. Wazuh’s documentation is explicit: “If the selected queue is full, the event is dropped.” That happens before the normal downstream rule match for that message, so it cannot produce an ordinary alert for the event. Wazuh’s analysisd documentation describes this queue behavior.
The three queue stages where events can be lost
| Stage | What is under pressure | Documented evidence | Where loss occurs |
|---|---|---|---|
| Agent | queue_ad, a leaky-bucket queue that smooths bursts |
Wazuh documents a flooding alert when the bucket fills | Subsequent events are dropped at the agent |
Manager: remoted |
Manager queues for agent communications and the feed to analysis | Discarded-message and queue fields in wazuh-remoted.state; API statistics |
Messages can be discarded before analysis |
Manager: analysisd |
Event-type decoder queues and their processing workers | Dropped-event and queue-usage fields in wazuh-analysisd.state; API statistics |
An event can be dropped before normal rule matching |
This is a practical way to organize the documented failure points, not a formal Wazuh taxonomy. The documented signal differs by stage: Wazuh describes an agent flooding alert, while its manager guidance emphasizes dropped or discarded counters, queue metrics, and state files. That does not rule out other alerts or integrations in a particular deployment.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
1. Agent-side congestion
The agent’s queue_ad regulates the rate at which events are sent, helping protect the network and manager from bursts. Wazuh distinguishes a warning from the more serious flooding alert: when the bucket fills, subsequent events are dropped. An event lost here never reaches the manager for analysis. See the Wazuh agent queue guide for the documented behavior and controls.
2. Manager remoted queue pressure
On the manager, queue_rd handles agent communications and queue_and feeds analysis. Pressure at this stage is separate from the agent bucket and from analysisd’s decoder queues. A message discarded here cannot proceed to analysis. The Wazuh queuing mechanisms guide covers queue sizing and the remoted.worker_pool setting.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
3. Manager analysisd decoder-queue pressure
Even after reaching the manager, a message can be lost if its selected analysisd queue is full. The state file exposes per-type queue usage and dropped-event information, helping identify which queue is under pressure rather than treating all event types as one stream. The analysisd state-file reference explains the fields.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the evidence in pipeline order
- Separate missing alerts from missing events. Check whether the concern is absent security alerts, absent archive records, or explicit queue drops. If archive logging is enabled, archives can help establish whether a collected event made it through the pipeline without matching an alert. Wazuh explains the distinction in its log collection overview and event logging documentation.
- Check agent congestion first. Review agent queue or congestion indicators and whether the flooding alert is occurring. Look for bursty or unnecessarily noisy inputs and relevant module rate controls.
- Inspect manager remoted statistics. Read
/var/ossec/var/run/wazuh-remoted.state. It includesqueue_size,total_queue_size,evt_count, anddiscarded_count. The file updates every five seconds by default; API statistics are another way to monitor the manager. See the remoted state-file reference. - Inspect analysisd statistics. Read
/var/ossec/var/run/wazuh-analysisd.stateforevents_dropped, event-type queue usage, event counts, and alerts written. It also updates every five seconds by default. The file can help assess a heavily loaded analysis engine; its example includes many queue sizes of 16,384, but that example is not a universal sizing recommendation. - Compare readings over time. A single snapshot may not show whether counters are increasing or queues are filling during a burst. Compare successive samples and correlate them with the time of missing activity.
- In Wazuh Cloud, check the usage metrics. The environment page provides “Events – Dropped over time” and “Events – Processed vs dropped.” Wazuh attributes drops to event rates exceeding configured average or peak EPS limits. Compare observed workload with the configured EPS capacity and review agent noise and burst patterns. See Monitor usage – Your environment.
Tune the bottleneck you can see
Reduce avoidable event volume and bursts
Before raising limits, check whether agents are collecting unnecessary or excessively noisy events. Wazuh provides rate-related controls in modules such as Logcollector and Syscollector, and its agent queue settings can help manage bursts. The documentation treats internal rate settings as advanced options, so change them carefully and verify that required security data is still collected.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Adjust manager queues and workers selectively
If wazuh-remoted.state shows drops, Wazuh documents increasing the <remote> queue_size or adjusting remoted.worker_pool. The current queue guide documents a default worker-pool value of 4 and permitted values from 1 to 16; those are configuration limits, not capacity recommendations. For analysisd, use queue-usage and dropped-event evidence to identify the affected event type, then adjust only the queues that show loss. The state-file example’s 16,384 queue sizes should not be copied as a sizing rule: the appropriate setting depends on event rates, event mix, and processing capacity.
Queue changes are not a substitute for diagnosing the source of pressure. Follow the queue guide’s instructions for applying configuration changes; a manager restart may be required. After a change, compare drop counters and queue usage again to determine whether the bottleneck has eased.
Account for Cloud EPS capacity
For Wazuh Cloud, compare processed and dropped events with the configured average and peak EPS limits. If rates exceed those limits, review the workload, noisy agent inputs, and burst smoothing rather than assuming that changing an on-premises queue setting applies to the hosted environment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Use the loss point to choose the next action
- Agent flooding alert: investigate burst shape, collection volume, and relevant agent rate controls; the documented failure is that subsequent events are dropped when the bucket fills.
- Rising remoted discarded count: focus on manager communication queue pressure and its queue or worker configuration.
- Rising analysisd drops or a saturated event-type queue: focus on that analysis queue and its processing capacity; the affected event may never reach rule matching.
- Cloud dropped-event metrics: compare event rate with configured average and peak EPS, then review agent configuration and unnecessary noise.
- No drops, but no alert: check whether the event was collected and archived, and whether it matched an applicable rule. Absence from alerts alone does not distinguish these possibilities.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
