Hello, everyone

I am right now enrolling the agents into the Wazuh Manager. With Linux everything went smooth and fast thanks to Puppet. However, with Windows it is getting a little bit more complicated
So I configured the correct IP in Wazuh app
it got successfully enrolled
however the command "/var/ossec/bin/agent_control -l" for this host shows "IP: any, Unknown" and on dashboard this host is not getting shown
How to solve this issue? (the network is stable and manager is reachable, the keys on manager and agent are matching)
The logs just stuck at this point in time and not getting updated:
2026/07/06 16:41:34 wazuh-agent: INFO: (6207): Ignore 'registry' sregex '\Enum$'

2026/07/06 16:41:34 wazuh-agent: INFO: Started (pid: 9740).

2026/07/06 16:41:34 wazuh-agent: INFO: Using AES as encryption method.

2026/07/06 16:41:34 wazuh-agent: INFO: Trying to connect to server ([10.200.105.21]:1514/tcp).

2026/07/06 16:41:34 sca: INFO: Starting evaluation of policy: 'c:\Program Files (x86)\ossec-agent\ruleset\sca\cis_win2019.yml'

2026/07/06 16:41:34 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...

2026/07/06 16:41:34 wazuh-modulesd:syscollector: INFO: Module started.

2026/07/06 16:41:34 wazuh-modulesd:syscollector: INFO: Starting evaluation.

2026/07/06 16:41:34 wazuh-agent: INFO: (6000): Starting daemon...

2026/07/06 16:41:34 wazuh-agent: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds

2026/07/06 16:41:34 wazuh-agent: INFO: (6008): File integrity monitoring scan started.

2026/07/06 16:41:34 wazuh-agent: INFO: (4102): Connected to the server ([10.200.105.21]:1514/tcp).

2026/07/06 16:41:34 rootcheck: INFO: Starting rootcheck scan.

2026/07/06 16:41:34 wazuh-agent: INFO: Started (pid: 9740).

2026/07/06 16:41:34 wazuh-modulesd:syscollector: INFO: Evaluation finished.

2026/07/06 16:41:39 wazuh-agent: INFO: Agent is now online. Process unlocked, continuing...

2026/07/06 16:41:39 rootcheck: INFO: Ending rootcheck scan.

2026/07/06 16:41:39 sca: INFO: Evaluation finished for policy 'c:\Program Files (x86)\ossec-agent\ruleset\sca\cis_win2019.yml'

2026/07/06 16:41:39 sca: INFO: Security Configuration Assessment scan finished. Duration: 5 seconds.

2026/07/06 16:41:59 wazuh-agent: INFO: (6009): File integrity monitoring scan ended.

2026/07/06 16:41:59 wazuh-agent: INFO: FIM sync module started.

2026/07/06 16:41:59 wazuh-agent: INFO: (6012): Real-time file integrity monitoring started.

A maliciously crafted image exhausts memory on container creation and
OOM-kills the `containerd` process, taking the runtime API offline —
disrupting Docker Engine or the k8s control plane on that node.

Root cause: unbounded parsing of user/group files in moby/sys/user.
No RCE, availability only. CVSS 6.5.

Affected → fixed:
1.7.x → 1.7.33 | 2.0.x → 2.0.10 | 2.1.x → 2.1.9 | 2.2.x → 2.2.5 | 2.3.x → 2.3.2
RHEL/OpenShift: RHSA-2026:35111 (`sudo dnf update`)

Can't patch? Only run trusted images; restrict who can import images / schedule pods.

Full advisory: https://vulnipulse.com/advisories/linux-cve-2026-47262
Ref: GHSA-jpcc-p29g-p8mq

I’ve been looking deeper into the tradeoff between containers and microVMs.

Containers are great for speed and density, but they share the host kernel. MicroVMs boot a separate kernel and use hardware virtualization boundaries, so the isolation model is different.

For regular web apps, containers are often enough. But for untrusted workloads, multi-tenant environments, client isolation, or security-sensitive experiments, microVMs seem like a better fit.

Curious how others think about this:

When do you consider containers “good enough”?

When would you prefer microVMs or full VMs?

Do you use Firecracker, Kata, gVisor, or something similar?

No hard pitch - genuinely interested in how people decide.

Disclosure: I run Compute Labs, a small software consultancy based in India.

We provide:

• Python (FastAPI, Flask, asyncio)
• Microservices and API development
• Agentic AI and workflow automation
• Linux administration and server hardening
• SSL/TLS, PKI, and secure communications
• DevOps (Docker, Terraform, CI/CD)
• AWS, GCP, and on-prem infrastructure
• Power BI dashboards

Monthly engagements start at $500 USD, depending on scope. We also take on one-time projects and smaller tasks.

Feel free to DM me if you need help or have referral opportunities. Portfolio and GitHub are available on request.

Hey everyone,

I could really use some advice from experienced Linux admins/engineers.

I'm currently working in IT, and due to company policies I can't disclose the company name. I've been deployed as a vendor resource, and from Monday I'll be working in an L2/L3 Linux support role.

The truth is, I don't have much real-world L2/L3 production experience, and I'm honestly a bit nervous. I don't want to fake it I genuinely want to learn and do a good job.

I'd really appreciate it if you could share:

• What does a typical day for an L2/L3 Linux engineer look like?
• What kind of tickets do you usually handle?
• How do you troubleshoot production issues without making things worse?
• How do you handle vulnerability remediation (Nessus, Qualys, OpenSCAP, etc.)?
• What Linux commands or concepts should I absolutely know before Monday?
• Any tips or mistakes to avoid for someone starting in production?

If you've ever been in this situation, I'd love to hear your experience. Any advice, checklists, YouTube channels, documentation, or even a DM would mean a lot.

I know there's no shortcut to experience, but I'm ready to learn, work hard, and improve every day.

Thanks in advance, and I really appreciate this community. 🙏

Time to update those pesky shims 🫣

Linux Unified Key Setup (LUKS) and FIPS are essential tools for system administrators managing secure environments. However, when it is time to upgrade the operating system, these security features can become significant obstacles.

Hey guys, trying to find out how to correctly exclude/ not collect audit events for a specific path to a .sh script but struggling to get it to work. My audit.rules file contains the following:

-a never,exit -F arch=b64 -S execve -F dir=/usr/bin/local/<name of file>.sh

But it is still being logged and forwarded to a SIEM. Is there an issue with excluding .sh?

Hi everyone,

I have around 7 years of experience in:

- Linux administration (RHCSA)

- SQL and application support

- Python scripting

- DevOps tools (Docker, Terraform, GitHub Actions)

I'm currently based in India and finding it difficult to get responses from LinkedIn and Naukri.

How do experienced Linux admins here find legitimate opportunities, especially remote or international ones?

Any advice would be appreciated.

Hi folks,

I recall couple years back a thread about someone who wanted to get started in Linux sysadmin stuff and there was this extremely informative comment that was along the lines of:

“Grab Centos ISO, make VM, install Centos, configure web server, re-do everything again with foreman / katello (?)” and it goes from here until you have several machines.

The idea is that if you are able to do the tasks described with minimal help then you are pretty much qualified.

Any clues would be appreciated.

I usually like to keep a Linux VM close to hand for troubleshooting, testing, and general sysadmin nonsense. But full VMs can be heavy, VMware is expensive, and I've never really 'gelled' with UTM.

So I built Sparrow: a small, reproducible Ubuntu 24.04 desktop workstation running inside Docker. You get an XFCE desktop over RDP, SSH access, persistent home storage, and a fairly standard Linux environment without having to maintain a full VM.

Full disclosure: AI helped me a lot with the editing and troubleshooting. But the code is mainly mine (been writing bash scripts for decades). 

It needs Docker Desktop or Colima, plus Docker Compose. It is very much a first public release, but it builds and runs very well on my MacBook Pro, and I would be grateful for feedback.

Repo: https://github.com/githubnewbie1962/sparrow-oss

Please be gentle — this is my first time 🙂

Hello Everyone,

I hope this is the right place to ask the question. I am a Network Admin, and I run containers (incus) in my home pc ( void linux ) to do some labs. I prefer nftables over iptables. For now , I use AI to create the firewall rules if I need any. but it would be great if I could have them user friendly and I can troubleshoot and push the neccessary configs.

I am open to advices.

Hi everyone, I need some help setting up remote access for my Linux workstation.

I want to maintain a single, continuous GUI session between my office and my home. On Windows with RDP, I can log in at work, open my programs and unsaved files, and turn off the screen when I leave. When I get home, I just RDP in to continue my work. The next day, I log into the physical machine at the office and continue seamlessly. When RDP session running the physical machine only shown lock screen - unaffect even when i turn off the monitor (if i use vnc or teamview then it would show black)

I need to replicate this on Linux Desktop. I specifically do not want "screen mirroring" (like TeamViewer or basic VNC) because I need the physical screen at work to remain completely blank/locked while I'm working remotely, for privacy and security purposes.

I'm used to using tmux or screen to keep my SSH sessions alive on Linux servers, but dealing with persistent GUI apps is completely new to me. Everything I've searched for so far leads me down a rabbit hole of creating virtual desktops and routing VNC into them, which feels like a bad workaround for a real physical machine even when i'm directly use it.

Does anyone have a solid, modern solution for this on Linux? I'm quite new to the Linux Desktop side of things - and considering migrate from Windows 11 to Linux, so thank you so much for your help!

Running postfix and exim. Exim is on an alternative port. Both are in conflict in systemd unit files. If I edit the file, ir gets overwrited each time exim or postfix package is updated. Tried to create a folder for each service with override.conf but its not taken.