wazuh-reload-rules

Reload Wazuh ruleset without restarting wazuh-manager — single manager or full cluster (master + all workers). Authenticates via the Wazuh API, triggers analysisd reload, prints per-node results, and surfaces ruleset issues in a parsed table.

Supports both single-manager and full cluster (master + all workers) reload.

Requirements

• curl, jq
• Wazuh API access (default port 55000)

Installation

cd /usr/local/bin/
wget -O wazuh-reload-rules https://raw.githubusercontent.com/adampielak/wazuh-reload-rules/refs/heads/main/wazuh-reload-rules.sh
chmod 0750 wazuh-reload-rules

Usage

Manager only (default)

wazuh-reload-rules -u https://localhost:55000 -U wazuh -p 'PASS' -k
# or via env
WAZUH_PASS='PASS' wazuh-reload-rules

Full cluster (master + all workers)

wazuh-reload-rules --cluster -u https://localhost:55000 -U wazuh -p 'PASS' -k
# or via env
WAZUH_PASS='PASS' CLUSTER=true wazuh-reload-rules

All options

  -u, --url        Wazuh API URL (default: https://127.0.0.1:55000)
  -U, --user       API username  (default: wazuh)
  -p, --pass       API password  (or set WAZUH_PASS)
  -k, --insecure   Skip TLS verification
  -L, --log        Path to ossec.log (default: /var/ossec/logs/ossec.log)
  -v, --verbose    Verbose HTTP output
      --cluster    Reload all cluster nodes via /cluster/analysisd/reload
      --no-table   Skip parsed ruleset issues table

Output examples

Manager only

[*] Authenticating to https://127.0.0.1:55000 as 'wazuh'…
[*] Requesting ruleset reload (manager only)…

[✓] API accepted reload request.
Message: Reload request sent to all specified nodes
Affected items: 1, Failed items: 0

Parsed ruleset issues:
Rule      Issue                 Detail
--------  --------------------  ----------------------------------------------
99909     if_sid_sig_missing    sid=89606
99909     if_sid_empty          if_sid empty
99910     if_sid_sig_missing    sid=89607
99910     if_sid_empty          if_sid empty

Cluster

[*] Authenticating to https://127.0.0.1:55000 as 'wazuh'…
[*] Requesting cluster-wide ruleset reload (all nodes)…

[✓] API accepted reload request.
Message: Reload request sent to all specified nodes
Affected items: 22, Failed items: 0

Per-node results:
Node                                  Status    Message
------------------------------------  --------  ------------------------------------------------
siem-manager-01-dc1                   OK        Ruleset reload request sent successfully.
siem-manager-01-dc2                   WARN      (7617): Signature ID '89606' was not found …
siem-manager-02-dc1                   OK        Ruleset reload request sent successfully.
...

Ruleset issues detected — breakdown:
[siem-manager-01-dc2]
Rule      Issue                 Detail
--------  --------------------  ----------------------------------------------
99909     if_sid_sig_missing    sid=89606
99909     if_sid_empty          if_sid empty

Author

Created by tick tick@linuxmafia.pl