The statistical file for wazuh-agentd is located at /var/ossec/var/run/wazuh-agentd.state.

This file provides information about the agent as the number of generated events, last connection, agent status, and some other useful information.

By default, this file is updated every 5 seconds. This interval can be changed by modifying the agent.state_interval value from the internal configuration file.


This file is created the first time the agent connects to the manager.

Below there is an example of the content of the file:

# State file for wazuh-agentd

# Agent status:
# - pending:      waiting for get connected.
# - connected:    connection established with manager in the last 10 seconds.
# - disconnected: connection lost or no ACK received in the last 60 seconds.

# Last time a keepalive was sent
last_keepalive='2019-02-05 12:18:37'

# Last time a control message was received
last_ack='2019-02-05 12:18:37'

# Number of generated events

# Number of messages (events + control messages) sent to the manager

# Number of events currently buffered
# Empty if anti-flooding mechanism is disabled


Statistics can also be acquired in real-time through the API.