ERROR (solved) while updating from 4.9.0 to 4.13.1 (wazuh-modulesd: ERROR: No such tag 'xxx' at module 'yyy'.)

[Meht-evaS]

Hi, I'm trying to update from 4.9.0 to 4.13.1 while keeping my custom configuration files.

As read in the following guide (for single-node stack):
https://documentation.wazuh.com/current/deployment-options/docker/upgrading-wazuh-docker.html#keeping-your-custom-docker-compose-files
the only thing I needed to do was download the new wazuh_manager.conf and apply my changes.

Below is the section of the file that raised the following exception (saw while building):

wazuh.manager-1    | 2025/10/20 23:43:34 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'enabled'.
wazuh.manager-1    | 2025/10/20 23:43:34 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
wazuh.manager-1    | 2025/10/20 23:43:34 sca: ERROR: No such tag 'synchronization' at module 'sca'.
wazuh.manager-1    | 2025/10/20 23:43:34 wazuh-modulesd: ERROR: (1202): Configuration error at 'etc/ossec.conf'.
wazuh.manager-1    | wazuh-modulesd: Configuration error. Exiting
wazuh.manager-1    | [cont-init.d] 2-manager: exited 1.
wazuh.manager-1    | [cont-init.d] done.
wazuh.manager-1    | [services.d] starting services
wazuh.manager-1    | starting Filebeat
wazuh.manager-1    | 2025/10/20 22:48:52 wazuh-modulesd: ERROR: No such tag 'users' at module 'syscollector'.
wazuh.manager-1    | 2025/10/20 22:48:52 wazuh-modulesd: ERROR: (1202): Configuration error at 'etc/ossec.conf'.
wazuh.manager-1    | 2025/10/20 23:33:18 wazuh-modulesd: ERROR: No such tag 'users' at module 'syscollector'.
wazuh.manager-1    | 2025/10/20 23:33:18 wazuh-modulesd: ERROR: (1202): Configuration error at 'etc/ossec.conf'.
wazuh.manager-1    | 2025/10/20 23:38:01 wazuh-modulesd: ERROR: No such tag 'users' at module 'syscollector'.
wazuh.manager-1    | 2025/10/20 23:38:01 wazuh-modulesd: ERROR: (1202): Configuration error at 'etc/ossec.conf'.
wazuh.manager-1    | 2025/10/20 23:43:34 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'enabled'.
wazuh.manager-1    | 2025/10/20 23:43:34 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
wazuh.manager-1    | 2025/10/20 23:43:34 sca: ERROR: No such tag 'synchronization' at module 'sca'.
wazuh.manager-1    | 2025/10/20 23:43:34 wazuh-modulesd: ERROR: (1202): Configuration error at 'etc/ossec.conf'.

NEW (4.13.1) wazuh_manager.conf (partial):

  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>
    <users>yes</users>
    <groups>yes</groups>
    <services>yes</services>
    <browser_extensions>yes</browser_extensions>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>

  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </sca>

OLD (4.9.0) wazuh_manager.conf (partial):

  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="no">yes</ports>
    <processes>yes</processes>

    <!-- Database synchronization settings -->
    <synchronization>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>

  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
    <skip_nfs>yes</skip_nfs>
  </sca>

It seems that the newly added tags are not recognized... in fact, those tags don't even appear in the official documentation:
https://documentation.wazuh.com/4.13/user-manual/reference/ossec-conf/wodle-syscollector.html

Do the tags actually not exist or were they simply not reported in the documentation?

By not modifying those sections, and thus keeping the changes from the OLD file, the build completed successfully... so I think the tags actually not exist, maybe? Or is the problem simply caused by modifying the wazuh_manager.conf file without updating the entire project?

Thanks in advance for your reply.

[Meht-evaS]

Also, if I may add, earlier in 4.9.0 it was possible to disable Wazuh updates via the following command:
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo
as seen in:
#1712

However, I have saw that in the manager container, more specifically in /etc/yum.repos.d, now appears amazonlinux.repo:

bash-5.2# ls -lha etc/yum.repos.d/  
total 16K
drwxr-xr-x 1 root root 4.0K Sep 24 14:13 .
drwxr-xr-x 1 root root 4.0K Oct 21 00:12 ..
-rw-r--r-- 1 root root  845 Sep  5 17:02 amazonlinux.repo

In the 4.13.1 documentation, the old repo still appears. I assume it hasn't been updated, right? Or am I missing something? Because in https://github.com/wazuh/wazuh-docker/blob/v4.13.1/build-docker-images/wazuh-manager/config/check_repository.sh it actually looks like you're still using it:
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo

Eventually, now, how should I disable the update repository?