[wazuh-agent:aptl-suricata-agent] starting; manager=wazuh.manager, paths=/logs/eve.json, format=json
[wazuh-agent:aptl-suricata-agent] waiting for wazuh.manager:1515 (auth)...
[wazuh-agent:aptl-suricata-agent] registering as 'aptl-suricata-agent' with wazuh.manager...
2026/06/11 16:01:00 agent-auth: INFO: Started (pid: 19).
2026/06/11 16:01:00 agent-auth: INFO: Requesting a key from server: wazuh.manager
2026/06/11 16:01:00 agent-auth: INFO: No authentication password provided
2026/06/11 16:01:00 agent-auth: INFO: Using agent name as: aptl-suricata-agent
2026/06/11 16:01:00 agent-auth: INFO: Waiting for server reply
2026/06/11 16:01:00 agent-auth: INFO: Valid key received
[wazuh-agent:aptl-suricata-agent] starting wazuh-agent...
Starting Wazuh v4.12.0...
Started wazuh-execd...
Started wazuh-agentd...
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.
[wazuh-agent:aptl-suricata-agent] ready; agentd pid=52; surfacing /var/ossec/logs/ossec.log
2026/06/11 16:01:00 wazuh-agentd: INFO: Using AES as encryption method.
2026/06/11 16:01:00 wazuh-agentd: INFO: Trying to connect to server ([wazuh.manager]:1514/tcp).
2026/06/11 16:01:01 wazuh-syscheckd: INFO: (6678): No directory provided for syscheck to monitor.
2026/06/11 16:01:01 wazuh-syscheckd: INFO: (6001): File integrity monitoring disabled.
2026/06/11 16:01:01 rootcheck: INFO: Rootcheck disabled.
2026/06/11 16:01:01 wazuh-logcollector: INFO: (1950): Analyzing file: '/logs/eve.json'.
2026/06/11 16:01:01 wazuh-modulesd: INFO: Started (pid: 81).
2026/06/11 16:01:01 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2026/06/11 16:01:01 wazuh-modulesd:control: INFO: Starting control thread.
2026/06/11 16:01:01 wazuh-logcollector: INFO: Started (pid: 73).
2026/06/11 16:01:10 wazuh-agentd: INFO: Closing connection to server ([wazuh.manager]:1514/tcp).
2026/06/11 16:01:10 wazuh-agentd: INFO: Trying to connect to server ([wazuh.manager]:1514/tcp).
2026/06/11 16:01:10 wazuh-agentd: INFO: (4102): Connected to the server ([wazuh.manager]:1514/tcp).
2026/06/11 16:01:10 wazuh-agentd: INFO: Agent is restarting due to shared configuration changes.
2026/06/11 16:01:11 wazuh-modulesd: INFO: Shutting down Wazuh modules.
2026/06/11 16:01:11 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2026/06/11 16:01:11 wazuh-syscheckd: INFO: (1756): Shutdown received. Releasing resources.
2026/06/11 16:01:11 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2026/06/11 16:01:11 wazuh-agentd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2026/06/11 16:01:11 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.
2026/06/11 16:01:11 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2026/06/11 16:01:13 wazuh-execd: INFO: Started (pid: 201).
2026/06/11 16:01:14 wazuh-agentd: INFO: (1410): Reading authentication keys file.
2026/06/11 16:01:14 wazuh-agentd: INFO: Using notify time: 10 and max time to reconnect: 60
2026/06/11 16:01:14 wazuh-agentd: INFO: Version detected -> Linux |wazuh-sidecar-suricata |6.8.0-117-generic |#117-Ubuntu SMP PREEMPT_DYNAMIC Tue May  5 19:26:24 UTC 2026 |x86_64 [Debian GNU/Linux|debian: 12 (bookworm)] - Wazuh v4.12.0
2026/06/11 16:01:14 wazuh-agentd: INFO: Started (pid: 212).
2026/06/11 16:01:14 wazuh-agentd: INFO: Using AES as encryption method.
2026/06/11 16:01:14 wazuh-agentd: INFO: Trying to connect to server ([wazuh.manager]:1514/tcp).
2026/06/11 16:01:14 wazuh-agentd: INFO: (4102): Connected to the server ([wazuh.manager]:1514/tcp).
[wazuh-agent:aptl-suricata-agent] wazuh-agentd (pid 52) exited; this script will exit so the supervisor restarts it
[wazuh-agent:aptl-suricata-agent] starting; manager=wazuh.manager, paths=/logs/eve.json, format=json
[wazuh-agent:aptl-suricata-agent] waiting for wazuh.manager:1515 (auth)...
[wazuh-agent:aptl-suricata-agent] registering as 'aptl-suricata-agent' with wazuh.manager...
2026/06/11 16:01:15 agent-auth: INFO: Started (pid: 19).
2026/06/11 16:01:15 agent-auth: INFO: Requesting a key from server: wazuh.manager
2026/06/11 16:01:15 agent-auth: INFO: No authentication password provided
2026/06/11 16:01:15 agent-auth: INFO: Using agent name as: aptl-suricata-agent
2026/06/11 16:01:15 agent-auth: INFO: Waiting for server reply
2026/06/11 16:01:15 agent-auth: ERROR: Duplicate agent name: aptl-suricata-agent (from manager)
2026/06/11 16:01:15 agent-auth: ERROR: Unable to add agent (from manager)
[wazuh-agent:aptl-suricata-agent] agent-auth duplicate-name error (attempt 1); existing client.keys retains identity
[wazuh-agent:aptl-suricata-agent] starting wazuh-agent...
Starting Wazuh v4.12.0...
Started wazuh-execd...
Started wazuh-agentd...
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.
[wazuh-agent:aptl-suricata-agent] ready; agentd pid=60; surfacing /var/ossec/logs/ossec.log
2026/06/11 16:01:17 wazuh-agentd: INFO: Trying to connect to server ([wazuh.manager]:1514/tcp).
2026/06/11 16:01:17 wazuh-agentd: INFO: (4102): Connected to the server ([wazuh.manager]:1514/tcp).
2026/06/11 16:01:18 wazuh-syscheckd: INFO: (6678): No directory provided for syscheck to monitor.
2026/06/11 16:01:18 wazuh-syscheckd: INFO: (6001): File integrity monitoring disabled.
2026/06/11 16:01:18 rootcheck: INFO: Rootcheck disabled.
2026/06/11 16:01:18 wazuh-logcollector: INFO: (1950): Analyzing file: '/logs/eve.json'.
2026/06/11 16:01:18 wazuh-logcollector: INFO: Started (pid: 84).
2026/06/11 16:01:18 wazuh-modulesd: INFO: Started (pid: 98).
2026/06/11 16:01:18 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2026/06/11 16:01:18 wazuh-modulesd:control: INFO: Starting control thread.
2026/06/12 00:00:10 wazuh-agentd: INFO: Running daily rotation of log files.
2026/06/12 00:00:10 wazuh-agentd: INFO: Starting new log after rotation.
