Linux and Unix agents

Open a session in your Linux/Unix agent host as root user. After that, you can register the Agent using agent-auth:

  1. Copy the CA (.pem file) to the /var/ossec/etc folder and run the agent-auth program:

# cp rootCA.pem /var/ossec/etc
# /var/ossec/bin/agent-auth -m 192.168.1.2 -v /var/ossec/etc/rootCA.pem

Note

Note that this method must include the -v option that indicates the location of the CA. If this option is not included, a warning message will be displayed and the connection will be established without verifying the manager.

  1. Edit the Wazuh agent configuration to add the Wazuh server IP address.

In the file /var/ossec/etc/ossec.conf, in the <client><server> section, change the MANAGER_IP value to the Wazuh server address:

<client>
  <server>
    <address>MANAGER_IP</address>
    ...
  </server>
</client>

  1. Start the agent.

  1. For Systemd:

# systemctl start wazuh-agent

  1. For SysV Init:

# service wazuh-agent start

  1. Other cases:

# /var/ossec/bin/ossec-control start