Debug Tools for Wazuh

This folder contains several Python scripts designed to help debug, analyze, and interact with Wazuh internals. Each script targets a specific aspect of Wazuh's operation, such as querying sockets, sending messages, or analyzing performance data.

csv-stat.py

Description

Analyzes CSV files generated by performance tests. Reports CPU and RSS statistics for a specified daemon/process.

Usage

python3 csv-stat.py <DAEMON> <FILE>

• <DAEMON>: Name of the process to filter.
• <FILE>: Path to the CSV file.

queue-mitm.py

Description

Man-in-the-middle tool for the Wazuh queue socket. Intercepts and forwards messages between daemons and the main queue socket for debugging and analysis.

Usage

python3 queue-mitm.py

• No arguments required.
• Restart Wazuh daemons after starting the tool.

sendmsg.py

Description

Sends messages to the main Wazuh queue (analysisd/agentd). Useful for testing message handling and queue operations.

Usage

python3 sendmsg.py [-L] [message]
echo "msg" | python3 sendmsg.py

• -L: Send the message in a loop until interrupted.
• message: Message to send (<id>:<location>:<log> format).

socket-query.py

Description

Sends queries to Wazuh module control sockets and prints the response. Useful for interacting with module APIs.

Usage

echo -n '{"command":"getconfig","parameters":{"section":"internal"}}' | python3 socket-query.py /var/wazuh-manager/queue/sockets/analysis

• First argument: Path to the Wazuh module control socket.
• Query is read from stdin.

wdb-query.py

Description

Performs concurrent queries to the Wazuh DB (WDB) using multiple workers. Reads queries from stdin and prints formatted responses.

Usage

python3 wdb-query.py [WORKERS]

• [WORKERS]: Number of concurrent connections (default: 8).
• Queries are read from stdin, one per line.

Notes

• All scripts require Python 3.
• Some scripts may require elevated permissions depending on socket/file access.
• Intended for debugging, development, and analysis purposes only.