Reduce High Volume of Inventory Events Generated by Agent

[vikman90]

Description

The Wazuh agent performs regular system inventory synchronization. By default, it is configured to inventory all supported data, including:

• Active processes
• Open ports
• Ports in use

Both active processes and ports in use tend to change frequently, resulting in a significant volume of stateful synchronization messages (create/delete events). While this behavior is expected given the current configuration, it can lead to an overload of events and potentially impact system performance.

Proposal

To reduce the volume of inventory synchronization messages, we propose disabling the following inventory options:

• Processes inventory: Disable inventory of active processes.
• Ports in use inventory: Disable inventory of ports in use.

These options can be adjusted in the agent configuration as follows:

processes: false
ports_all: false

This adjustment is expected to significantly reduce the number of inventory-related events without affecting other critical functionalities.