CentOS 6 or greater from sources
This guide describes how to install the Wazuh agent from source code for CentOS 6 or greater. For other operating systems or Linux distributions, please check the list: Install Wazuh agent.
Note
All the commands described below need to be executed with root user privileges.
Installing Wazuh agent
Install development tools and compilers. In Linux this can easily be done using your distribution's package manager:
# yum install make gcc policycoreutils-python automake autoconf libtool
Download and extract the latest version:
# curl -Ls https://github.com/wazuh/wazuh/archive/v3.13.6.tar.gz | tar zx
Run the
install.sh
script. This will run a wizard that will guide you through the installation process using the Wazuh sources:# cd wazuh-* # ./install.sh
If you have previously compiled for another platform, you must clean the build using the Makefile in
src
:# cd wazuh-* # make -C src clean # make -C src clean-deps
Note
During the installation, users can decide the installation path. Execute the
./install.sh
and select the language, set the installation mode toagent
, then set the installation path (Choose where to install Wazuh [/var/ossec]
). The default path of installation is/var/ossec
. A commonly used custom path might be/opt
. When choosing a different path than the default, if the directory already exist the installer will ask if delete the directory or if installing Wazuh inside. You can also run an unattended installation.Note
Since Wazuh 3.5 it is necessary to have internet connection when following this step.
The script will ask about what kind of installation you want. Type
agent
in order to install a Wazuh agent:
1- What kind of installation do you want (manager, agent, local, hybrid or help)? agent
Now that the agent is installed, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit the document: user manual.
Uninstall
To uninstall Wazuh agent:
# OSSEC_INIT="/etc/ossec-init.conf" # . $OSSEC_INIT 2> /dev/null
Stop the service:
# service wazuh-agent stop 2> /dev/null
Stop the daemon:
# $DIRECTORY/bin/ossec-control stop 2> /dev/null
Remove files and service artifacts:
# rm -rf $DIRECTORY $OSSEC_INIT
Delete the service:
For SysV Init:
# [ -f /etc/rc.local ] && sed -i'' '/ossec-control start/d' /etc/rc.local # find /etc/{init.d,rc*.d} -name "*wazuh" | xargs rm -fFor Systemd:
# find /etc/systemd/system -name "wazuh*" | xargs rm -f # systemctl daemon-reload
Remove users:
# userdel ossec 2> /dev/null # userdel ossecm 2> /dev/null # userdel ossecr 2> /dev/null # groupdel ossec 2> /dev/null