Overview
The Ironclad Agent writes a plain-text log file during installation and ongoing operation. On Windows this file lives at:
C:\Program Files\decianx-agent\log.txt
On Linux and macOS, logs are written to the platform log directory (e.g. /var/log/decianx-agent/install.log).
Every line follows the same format:
YYYY-MM-DD HH:MM:SS - [component]: message text
This guide covers the most common messages you'll encounter, what they mean, and what (if anything) you should do about them.
Log entries from different components are all written to the same file. The component name in brackets — like installWazuh, trimOssecConf, or yara-refresh — tells you which part of the agent wrote the line. Use this to narrow down which component to focus on when something isn't right.
General Installer Messages
| Log message |
What it means |
Action needed? |
Created log file at C:\Program Files\decianx-agent\log.txt |
The agent created its log file for the first time. This is the first entry on a fresh install. |
None — this is normal. |
config.yaml created successfully |
The agent's runtime configuration file was written successfully. |
None. |
Installation completed |
The installer script finished its work. All selected components completed their install steps. |
None — installation was successful. |
<component> is already installed. Skipping installation. |
The installer detected that this component (e.g. wazuh-agent) is already present on the system. It skipped reinstalling it to avoid disrupting a running service. |
None, unless you expected a fresh install. If you need to force a reinstall, uninstall the component first and then re-run the agent installer. |
<param> is missing, exiting... |
A required installation parameter was not provided. The installer will exit without completing. |
Check that all required flags were passed to the installer. See the Ironclad Agent installation guide for the full flag reference. |
Wazuh Agent Messages
| Log message |
What it means |
Action needed? |
installWazuh: wazuh-agent set to install |
The installer recognized the Wazuh flag and is beginning Wazuh installation. |
None — informational. |
installWazuh: wazuh-agent install complete. |
The Wazuh MSI installed without errors. |
None. |
installWazuh: Minimizing ossec.conf before service start |
The installer is about to rewrite ossec.conf to a minimal configuration. This is expected — the default Wazuh config is intentionally stripped so your SIEM manager controls agent policy. |
None — this is by design. |
installWazuh: ossec.conf minimization step completed |
The configuration rewrite finished successfully. |
None. |
installWazuh: ossec.conf minimization step threw an exception: ... |
The config rewrite failed. The Wazuh agent may still start, but will use the default verbose config rather than the minimal one. This can cause conflicts with policies pushed from the manager. |
Contact Decian support and share the full exception text. In the meantime, the agent will likely still connect to your SIEM — check your Wazuh manager dashboard to confirm. |
installWazuh: wazuh-agent has been started |
The Wazuh service started successfully after installation. |
None. |
ossec.conf Rewrite Messages (trimOssecConf)
| Log message |
What it means |
Action needed? |
trimOssecConf: starting |
The config rewrite script has started. |
None. |
trimOssecConf: ossec.conf not found at ... -- skipping |
Wazuh either didn't install correctly, or its config file isn't at the expected path. The rewrite was skipped. |
Verify Wazuh installed successfully. Check C:\Program Files (x86)\ossec-agent\ for the ossec.conf file. If it's missing, try reinstalling Wazuh by running the agent installer again. |
trimOssecConf: wazuh service running -- stopping before rewrite |
The Wazuh service was running when the rewrite started. It was stopped temporarily to safely edit the config file. |
None — this is expected. |
trimOssecConf: already minimal -- nothing to do |
The config file was already in minimal form (no <localfile> or <syscheck> blocks). This happens on reinstalls or upgrades. |
None. |
trimOssecConf: failed to parse ossec.conf as XML: ... |
The existing ossec.conf contains invalid XML. This can happen if a previous installation was interrupted. |
Contact Decian support. You can also try manually deleting ossec.conf and reinstalling the agent — the installer will create a clean copy. |
trimOssecConf: ossec.conf rewritten successfully -- manager=... enroll=... |
The config was successfully rewritten. The manager and enrollment addresses shown in the message confirm which SIEM the agent is configured to connect to. |
Verify the hostnames shown match your expected SIEM addresses. If they don't, contact Decian support. |
trimOssecConf: failed to write ossec.conf: ... |
The script couldn't save the rewritten config. Usually a permissions issue. |
Ensure the installer was run as an administrator. If the problem persists, contact Decian support. |
Stunnel Messages
| Log message |
What it means |
Action needed? |
stunnel.exe not found at ..., exiting stunnel installation... |
The installer couldn't find the Stunnel binary at the expected path. Stunnel was not installed. |
This typically means the binary wasn't included in the installer bundle. Contact Decian support to confirm you received the correct installer package. |
Writing stunnel configuration |
The installer is about to write the stunnel.conf file with your organization's agent and enrollment hostnames. |
None — informational. |
Stunnel service is running successfully |
Stunnel was installed as a Windows service and started without errors. |
None. |
Failed to start Stunnel service |
Stunnel installed but the service did not start. Wazuh traffic will not be encrypted until this is resolved. |
Open Windows Services (services.msc), find Decianx-tls-tunnel, and check its status. Try starting it manually. If it fails, contact Decian support with the Windows Event Log entries for the service. |
nssm.exe not found at ... |
The service manager binary used to register Stunnel (and Logstash) as Windows services was not found. Neither service will be registered. |
Contact Decian support — the installer bundle is missing a required file. |
Logstash Messages
| Log message |
What it means |
Action needed? |
Checking install of <service> version <x> |
The Logstash installer is starting and verifying what it needs to set up. |
None. |
Downloading Logstash from ... |
The installer is downloading the Logstash archive from Elastic. This step requires internet access. |
None — wait for the download to complete. If it times out, check the endpoint's internet connectivity. |
logstash.conf created successfully |
Logstash was configured to collect syslog on port 514 and write logs to the agent directory. |
None. |
Logstash service is running successfully |
Logstash installed and started without errors. |
None. |
Failed to start Logstash service |
Logstash installed but didn't start. Syslog collection will not work until this is resolved. |
Open Windows Services, find Decianx-syslog-receiver, and try starting it manually. Check if port 514 is already in use by another application. Contact Decian support if the problem persists. |
syslog.log not found after <n> retries, exiting script |
Logstash started but isn't producing log files within the expected timeframe. This could mean Logstash is still initializing, or something is preventing it from writing to disk. |
Wait a few minutes and check if the log file appears at C:\Program Files\decianx-agent\Logstash\logs\syslog\. If not, check the Logstash service status and disk space on the endpoint. |
YARA Messages
| Log message |
What it means |
Action needed? |
installYara: starting YARA active-response deployment |
The YARA installer has started. It will copy the active-response script into Wazuh's bin directory. |
None. |
installYara: yara.bat deployed successfully |
The active-response script is in place. Your SIEM manager can now trigger on-demand file scans on this endpoint. |
None. |
installYara: ERROR - yara.bat not found at source path -- aborting |
The yara.bat script wasn't in the installer bundle. |
Contact Decian support to verify you have the correct installer package. |
installYara: ERROR - Wazuh active-response bin not found at ... |
Wazuh didn't install correctly, or isn't installed at all. YARA can't be wired in without a working Wazuh installation. |
Check earlier in the log for Wazuh installation errors. Resolve those first, then re-run the installer. |
yara-refresh: Valhalla rules applied successfully |
YARA rules were updated from the Valhalla premium threat intelligence feed. Your endpoint has the latest ruleset. |
None. |
yara-refresh: Valhalla rules failed compile check — trying GitHub fallback |
The downloaded Valhalla rules didn't pass YARA's compile validation. The refresh script is falling back to the open-source ruleset automatically. |
This is usually a temporary issue with the feed. If it happens repeatedly, contact Decian support. |
yara-refresh: GitHub rules applied (<n> files) |
YARA rules were updated from the open-source Neo23x0/signature-base ruleset on GitHub. This is the fallback source when Valhalla isn't configured or isn't available. |
None — rules are current. |
yara-refresh: GitHub rules failed compile check — keeping existing rules |
Both the Valhalla and GitHub rulesets failed validation. The existing rules on disk were kept unchanged. |
Contact Decian support. The existing rules are still active, but they may be outdated. |
yara-refresh: No rules downloaded — keeping existing rules |
The refresh script couldn't download any rules, possibly due to a network connectivity issue. |
Check the endpoint's internet connectivity. Rules will retry on the next scheduled run (every 24 hours). |
Sysmon Messages
| Log message |
What it means |
Action needed? |
installSysmon: Sysmon64 service already present -- skipping install |
Sysmon is already installed on this endpoint. The installer won't overwrite it. |
None — this is expected on reinstalls or upgrades. |
installSysmon: ERROR - failed to download config -- ... |
The installer couldn't reach GitHub to download the Decian Sysmon configuration. Sysmon was not installed. |
Check the endpoint's internet connectivity and try again. If the endpoint is air-gapped, contact Decian support for an offline installer. |
installSysmon: ERROR - Sysmon64.exe not found after extraction |
The Sysmon zip downloaded but the expected binary wasn't inside it. The archive may have been corrupted in transit. |
Re-run the installer. If the issue persists, contact Decian support. |
installSysmon: Sysmon installed successfully |
Sysmon is running with the Decian configuration. Detailed process, network, and file activity events are now being captured. |
None. |
installSysmon: ERROR - Sysmon installation failed -- ... |
The Sysmon installer returned a non-zero exit code. Sysmon may not be running. |
Check Windows Services for a Sysmon64 entry. If it's missing, contact Decian support with the full error message from the log. |
Windows Logging Enablement Messages (enableWindowsLogging)
When Wazuh is installed, the agent also runs a script that configures Windows audit policies to generate the event IDs your SIEM rules depend on. Each section reports its outcome:
| Log message |
What it means |
Action needed? |
OK audit/<subcategory> success:enable failure:enable |
A Windows audit policy was enabled successfully. Events in this category will now be written to the Security event log. |
None. |
WARN audit/<subcategory> failed (exit code <n>): ... |
A specific audit policy couldn't be enabled. This usually means the endpoint is joined to a domain where Group Policy is overriding local audit settings. |
If the endpoint is domain-joined, work with your IT team to confirm that the required audit policies are being applied via GPO. Contact Decian support for a list of required policy settings. |
WARN Sysmon not installed or not running. EID 1,3,22,25 will not be generated. |
Sysmon isn't running, so certain high-value event IDs won't be available to your SIEM. This is only a concern if Sysmon installation was expected. |
If Sysmon should be installed, re-run the installer with /SYSMON_INSTALL=true. |
Script completed -- all sections OK |
All audit policies and supporting services were configured successfully. |
None — the endpoint is fully configured for SIEM event collection. |
Script completed -- one or more sections had warnings or failures |
Some audit policies or services couldn't be configured. Check earlier in the log for WARN or FAIL lines to see which ones. |
Review the specific warnings above. Domain-joined endpoints frequently produce warnings here that are better resolved through Group Policy — contact your IT team or Decian support. |
Upgrade Messages
| Log message |
What it means |
Action needed? |
Upgrade requested version=<version> |
The upgrade script started. The version being downloaded is shown. |
None. |
Download complete. |
The new installer was downloaded successfully. |
None. |
Stopping service: <name> |
The upgrade script stopped a running service so the installer can safely replace files. |
None — services will be restarted when the upgrade completes. |
Installer finished. Restarting services... |
The new version installed successfully and services are being brought back up. |
None. |
Upgrade to <version> completed successfully. |
The upgrade finished. The agent is running the new version. |
None. |
ERROR: Installer exited with code <n> |
The new installer ran but reported an error. The previous version may still be installed. |
Contact Decian support with the version number and exit code. Do not run the upgrade again until the cause is understood, to avoid leaving the agent in a partially upgraded state. |
WARN service <name> not found after upgrade -- skipping restart |
A service that was running before the upgrade isn't registered in Windows after it completed. This may indicate the upgrade didn't fully apply. |
Check Windows Services for the affected service. If it's missing, contact Decian support. |
Still Stuck?
If a log message you're seeing isn't covered here, or if you've followed the recommended steps and the issue persists, reach out to Decian support. When you do, please attach the full log.txt file — it contains the complete install history and makes it much faster to diagnose what went wrong.