wazuh-modulesd: String limit reached

grep -B3 'String limit reached' /var/ossec/logs/ossec.log | tail -n 20

/path/to/the/command | wc -c

Why it happens

In 4.14.7, src/wazuh_modules/wm_exec.c reads a child program's output into one string. The cap is WM_STRING_MAX, defined in wmodules.h as 67108864 (64 MB). When the next read would pass it, the reader logs String limit reached. and breaks out of the loop. The output collected so far is kept; the rest is never read. The Windows reader in the same file (around line 235, reading the pipe with ReadFile) has the same cap and prints the same warning.

The same execution path is used by modules that run an external program: the command wodle, and, from the source, the AWS, Azure and GCP modules and SCA commands.

We configured a command wodle whose script prints a first line, 70,000,000 bytes, then a last line:

Fix

The limit is a compile-time constant, not a setting, so the fix is on the producing side: make each run print less than 64 MB.

• Command wodle: run it more often over a smaller window (for example a time range per run), filter in the script, or drop fields you do not alert on.
• Or write to a file and read it with <localfile>, which reads line by line instead of one string per run. Rotate the file.
• Cloud modules: narrow what one run fetches (fewer services or buckets per module block, a shorter interval so each run covers less time).

After the change, run the program by hand and pipe it to wc -c again; stay well below the limit, since a busy day produces more than a quiet one.