The first thing 5.0 broke for me was not a feature. It was a habit.
When something looks stuck on a Wazuh 4.x server, you restart the manager. It is the cheapest diagnostic move there is, and on the 4.x installations I have run it has been safe, because by the time the manager restarts the alert is already written to disk. So I did the same thing on a 5.0.0 Beta 5 stand while its indexer happened to be down. Of the hundred events whose presence in the agent file was confirmed before that restart, none reached the indexer afterwards. How many the manager had already accepted I cannot say: 5.0 exposes no point between acceptance and indexing, which is part of what this comparison is about.
[Read More]