Wazuh FIM reached 100000 files: don't raise the limit blindly

Problem

Wazuh FIM reaches the maximum monitored file limit, for example 100000 files.

Why it happens

The agent may monitor too many noisy paths such as cache directories, temporary files, build folders, package directories, or container overlay filesystems. Those paths consume the watch budget before the important directories are covered well.

Fix / Approach

Reduce noisy monitored paths before increasing `file_limit`. Raising the limit without cleanup can increase resource usage and still miss the real tuning problem.

Command / Config

Example noisy paths to review:

<ignore>/var/lib/docker/overlay2</ignore>
<ignore>/tmp</ignore>
<ignore>/var/cache</ignore>
<ignore>/var/lib/containerd</ignore>

When to use

• Busy Linux servers
• Container hosts
• Lab environments
• Workloads with many temporary files

When not to use

• Critical compliance paths that must be monitored
• Systems where the correct fix is a genuinely larger monitored file limit

Common mistakes

• Increasing `file_limit` before reviewing the monitored path scope
• Monitoring cache and overlay paths by default
• Treating larger coverage as automatically better coverage