Upgrading the Wazuh agent

The following steps show how to upgrade the Wazuh agent to the latest available version. Since Wazuh 3.x, it is possible to upgrade the Wazuh agents either remotely from the Wazuh manager or locally. Upgrading the Wazuh agents remotely is possible by using the agent_upgrade tool or the Wazuh API. More information about the process can be found in the Remote agent upgrade section.

To perform the upgrade locally, follow the instructions for the operating system of the Wazuh agent:

Yum

APT

ZYpp

Windows

macOS

AIX

Solaris 11

Solaris 10

HP-UX

  1. Import the GPG key:

    # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

  2. Add the repository:

    # cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

  3. Clean the YUM cache:

    # yum clean all

  4. Upgrade the Wazuh agent to the latest version:

    # yum upgrade wazuh-agent

  5. It is recommended to disable the Wazuh repository in order to avoid undesired upgrades and compatibility issues as the Wazuh agent should always be in the same or an older version than the Wazuh manager:

    # sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

  1. Install the GPG key:

    # curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -

  2. Add the repository:

    # echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

  3. Upgrade the Wazuh agent to the latest version:

    # apt-get update
# apt-get install wazuh-agent

  4. It is recommended to disable the Wazuh repository in order to avoid undesired upgrades and compatibility issues as the Wazuh agent should always be in the same or an older version than the Wazuh manager. Skip this step if the package is set to a hold state:

    # sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
# apt-get update

  1. Import the GPG key:

    # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

  2. Add the repository:

    # cat > /etc/zypp/repos.d/wazuh.repo <<\EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

  3. Upgrade the Wazuh agent to the latest version:

    # zypper update wazuh-agent

  4. It is recommended to disable the Wazuh repository in order to avoid undesired upgrades and compatibility issues as the Wazuh agent should always be in the same or an older version than the Wazuh manager:

    # sed -i "s/^enabled=1/enabled=0/" /etc/zypp/repos.d/wazuh.repo

The Wazuh agent upgrading process for Windows systems requires to download the latest Windows installer. There are two ways of using the installer, both of them require administrator rights.

  1. Using the GUI installer. Open the installer and follow the instructions to upgrade the Wazuh agent:

    ../_images/windows1.png

  2. Using the command line. To upgrade the Wazuh agent from the command line, run the installer using Windows PowerShell or the command prompt. The /q argument is used for unattended installations:

# wazuh-agent-4.0.4-1.msi /q

The Wazuh agent upgrading process for macOS systems requires to download the latest macOS installer. There are two ways of using the installer.

  1. Using the GUI will perform a simple upgrade. Double click on the downloaded file and follow the wizard. If you are not sure how to answer some of the prompts, simply use the default answers:

../_images/macos2.png

  1. Using the command line:

# installer -pkg wazuh-agent-4.0.4-1.pkg -target /

The Wazuh agent upgrading process for AIX systems requires to download the latest AIX installer and run the following command:

# rpm -U wazuh-agent-4.0.4-1.aix.ppc.rpm

The Wazuh agent upgrading process for Solaris 11 systems requires to download the latest Solaris 11 i386 installer or Solaris 11 sparc installer depending on the Solaris 11 host architecture.

  1. Stop the Wazuh agent:

    # /var/ossec/bin/ossec-control stop

  2. After that, upgrade the Wazuh agent. Choose one option depending on the host architecture:

    • Solaris 11 i386:

      # pkg install -g wazuh-agent_v4.0.4-sol11-i386.pkg wazuh-agent

    • Solaris 11 sparc:

      # pkg install -g wazuh-agent_v4.0.4-sol11-sparc.pkg wazuh-agent

  3. Start the Wazuh agent:

    # /var/ossec/bin/ossec-control start

The Wazuh agent upgrading process for Solaris 10 systems requires to download the latest Solaris 10 i386 installer or Solaris 10 sparc installer depending on the Solaris 10 host architecture.

  1. Stop the Wazuh agent:

    # /var/ossec/bin/ossec-control stop

  2. Backup the ossec.conf configuration file:

    # cp /var/ossec/etc/ossec.conf ~/ossec.conf.bk
# cp /var/ossec/etc/client.keys ~/client.keys.bk

  3. Remove the Wazuh agent:

    # pkgrm wazuh-agent

  4. After that, install the Wazuh agent. Choose one option depending on the host architecture:

    • Solaris 10 i386:

      # pkgadd -d wazuh-agent_v4.0.4-sol10-i386.pkg wazuh-agent

    • Solaris 10 sparc:

      # pkgadd -d wazuh-agent_v4.0.4-sol10-sparc.pkg wazuh-agent

  5. Restore the ossec.conf configuration file:

    # mv ~/ossec.conf.bk /var/ossec/etc/ossec.conf
# chown root:ossec /var/ossec/etc/ossec.conf

  6. Start the wazuh-agent:

    # /var/ossec/bin/ossec-control start

The Wazuh agent upgrading process for HP-UX systems requires to download the latest HP-UX installer.

  1. Stop the Wazuh agent:

    # /var/ossec/bin/ossec-control stop

  2. Backup the ossec.conf configuration file:

    # cp /var/ossec/etc/ossec.conf ~/ossec.conf.bk
# cp /var/ossec/etc/client.keys ~/client.keys.bk

  3. Deploy the Wazuh agent files:

    # tar -xvf wazuh-agent-4.0.4-1-hpux-11v3-ia64.tar

  4. Restore the ossec.conf configuration file:

    # mv ~/ossec.conf.bk /var/ossec/etc/ossec.conf
# chown root:ossec /var/ossec/etc/ossec.conf
# mv ~/client.keys.bk /var/ossec/etc/client.keys
# chown root:ossec /var/ossec/etc/client.keys

  5. Start the wazuh-agent:

    # /var/ossec/bin/ossec-control start

Once the Wazuh agent is upgraded, if it still uses UDP, which was the default protocol for versions prior to Wazuh 4.x, it must be changed to TCP in the ossec.conf file:

<ossec_config>
  <client>
    <server>
      <address>172.16.1.17</address>
      <port>1514</port>
      <protocol>udp</protocol>
    </server>