Hi team!

I've noticed an weird behaviour when canceling the update of the rules using /var/ossec/bin/update_ruleset.

Context:

• OS: Ubuntu 16.04
• Clean installation of Wazuh Manager 3.9 (Revision: 3918) using DEB packages.

Problem:

After executing /var/ossec/bin/update_ruleset -b 3.9 and the message "Ossec requires a restart to apply updates. Do you want to restart OSSEC now? As I understood, when rejecting, the update aborts. But the update is applied and OSSEC is not restarted. This could cause confussion since lot of people could understand that the script is asking for verification in order to update, not verification to restart OSSEC.

IMHO, there should a confirmation in order to update ruleset since this could cause an unwanted update.

Steps to reproduce:

• Install Wazuh Manager 3.9 from deb packages.
• Execute /var/ossec/bin/update_ruleset -b 3.9

Regards!

Jose