This is the documentation for Wazuh 3.2. Check out the docs for the latest version of Wazuh!

client_buffer

XML section name

<client_buffer>
</client_buffer>

This section shows how to configure the agent bucket parameters in order to avoid events flooding.

Options

disabled

Toggles the agent buffer on and off. When set to yes, the agent will send events to the manager without any congestion control.

Default value no
Allowed values yes, no

Warning

Disabling this functionality in large environments may overwhelm the manager and the network causing them to fail.

disable

Deprecated since version 3.1.

Toggles the agent buffer on and off. When set to yes, the agent will send events to the manager without any congestion control. Due to compatibility issues, it is recommended that this option be replaced by the disabled parameter.

Default value no
Allowed values yes, no

Warning

Disabling this functionality in large environments may overwhelm the manager and the network causing them to fail.

queue_size

Sets the capacity of the agent buffer in number of events.

Default value 5000
Allowed values Any number between 1 and 100000.

length

Deprecated since version 3.0.

Sets the capacity of the agent buffer in number of events.

Default value 5000
Allowed values Any number between 1 and 100000.

Warning

Even if this field is accepted, it is recommended that it be replaced with the queue_size parameter.

events_per_second

Specifies the number of events that can be sent to the manager per second.

Default value 500
Allowed values Any number between 1 and 1000.

Default configuration

<client_buffer>
  <!-- Agent buffer options -->
  <disabled>no</disabled>
  <queue_size>5000</queue_size>
  <events_per_second>500</events_per_second>
</client_buffer>