healthcheck_rules.xml

<group name="wazuh,healthcheck">
  <rule id="100010" level="5">
    <decoded_as>json</decoded_as>
    <field name="healthy">\.+</field>
    <description>Wazuh Health Check</description>
    <options>no_full_log</options>
  </rule>
  <rule id="100011" level="5">
    <if_sid>100010</if_sid>
    <field name="healthy">yes</field>
    <description>All Wazuh Services Are Healthy</description>
    <options>no_full_log</options>
  </rule>
  <rule id="100012" level="5">
    <if_sid>100010</if_sid>
    <field name="healthy">attempting_restart</field>
    <description>Wazuh Service $(wazuhprocess) is in a failed state. Attempting a restart</description>
    <options>no_full_log</options>
  </rule>
  <rule id="100013" level="12">
    <if_sid>100010</if_sid>
    <field name="healthy">no</field>
    <description>Wazuh Service $(wazuhprocess) is in a failed state</description>
    <options>no_full_log</options>
  </rule>
  <rule id="100014" level="5">
    <decoded_as>json</decoded_as>
    <field name="cpu">\.+</field>
    <description>Metrics Health Check</description>
    <options>no_full_log</options>
  </rule>
  <rule id="100015" level="12">
    <if_sid>100014</if_sid>
    <field name="ram">^8\.+|^9\.+|^100\.+</field>
    <description>Memory Usage is High $(ram)</description>
    <options>no_full_log</options>
  </rule>
  <rule id="100016" level="12">
    <if_sid>100014</if_sid>
    <field name="cpu">^8\.+|^9\.+|^100\.+</field>
    <description>CPU Usage is High $(cpu)</description>
    <options>no_full_log</options>
  </rule>
  <rule id="100017" level="12">
    <if_sid>100014</if_sid>
    <field name="disk">^7\.+|^8\.+|^9\.+|^100\.+</field>
    <description>Disk Space is Running Low $(disk)</description>
    <options>no_full_log</options>
  </rule>
</group>