QA Planning: EPS, remove multiple logs to show the same configuration warning message

[QU3B1M]

Description

This problem aims to investigate the pr #15278 to define the test cases to be carried out.

Development stage

• Research the applied change.
• Research if we have a test for this case.
• Define the test cases. Identify the base cases, and then the rest of the tests as tier 2.
• Define whether it is necessary to test systems, integration, or E2E. Create the corresponding issues.

[QU3B1M]

Research the applied change

This change aims to reduce the amount of warnings that are raised when a wazuh-manager with EPS block enabled has no tag.

Research if we have a test for this case

Yes, we do have automated test for this case that should be adapted to this new modification

Define the test cases. Identify the base cases, and then the rest of the tests as tier 2

Test cases

• EPS limit disabled

  1. Install wazuh-manager
  2. Remove or comment the EPS block

     <!--limits>
       <eps>
         <maximum>50</maximum>
         <timeframe>30</timeframe>
       </eps>
     </limits-->

  3. Restart the wazuh-manager
  4. Check the INFO message is raised in ossec.log
expected

     grep "INFO" /var/ossec/logs/ossec.log
     
     2022/11/02 11:35:01 wazuh-analysisd: INFO: EPS limit disabled
     

• EPS limit enabled

  1. Install wazuh-manager
  2. Config the EPS block correctly

     <limits>
       <eps>
         <maximum>50</maximum>
         <timeframe>30</timeframe>
       </eps>
     </limits>

  3. Restart the wazuh-manager
  4. Check the INFO message is raised in ossec.log
expected

     grep "INFO" /var/ossec/logs/ossec.log
     
     2022/11/02 11:41:35 wazuh-analysisd: INFO: EPS limit enabled, EPS: '50', timeframe: '30'
     

• EPS limit enabled without maximum tag

  1. Install wazuh-manager
  2. Config the EPS block without the tag <maximum>

     <limits>
       <eps>
         <!-- <maximum>50</maximum> -->
         <timeframe>30</timeframe>
       </eps>
     </limits>

  3. Restart the wazuh-manager
  4. Check the INFO message is raised in ossec.log
expected

     grep "WARNING" /var/ossec/logs/ossec.log
     
     2022/11/02 11:39:03 wazuh-analysisd: WARNING: EPS limit disabled. The maximum value is missing in the configuration block.
     

• EPS limit enabled without timeframe tag

  1. Install wazuh-manager
  2. Config the EPS block without the tag <timeframe>

     In this case, it will use the default timeframe: 10

     <limits>
       <eps>
         <maximum>50</maximum>
         <!-- <timeframe>30</timeframe> -->
       </eps>
     </limits>

  3. Restart the wazuh-manager
  4. Check the INFO message is raised in ossec.log
expected

     grep "INFO" /var/ossec/logs/ossec.log
     
     2022/11/02 11:42:26 wazuh-analysisd: INFO: EPS limit enabled, EPS: '50', timeframe: '10' 
     

Define whether it is necessary to test systems, integration, or E2E. Create the corresponding issues

We have integration tests to update

Issues

• Adapt tests to new EPS logs #3559
• Validate the logs modification in EPS analysisd  #3549