u/inb4ransomware

▲ 1 r/Wazuh

wazuh FIM nodiff exclusions are still copied

Hi!
I'm currently testing wazuh FIM for auditing our win2019 fileserver and ran into unexpected behaviour. The folder I want to monitor contains about 50:50 binary files and text files. I've enabled report_changes. Obviously this only makes sense for text files, so I excluded the binary file extensions via regex. All files are roughly the same size, so a size filter won't work.

The dashboard shows "diff truncated due to nodiff" for the binary files which is expected, but the excluded files are still copied to queue\diff\file.
Not only does this take up space, it also puts unneccesary load on the system. Is there any way to stop wazuh from copying excluded files?

server & agent 14.14.7

reddit.com
u/inb4ransomware — 2 days ago