Installing the Wazuh agent from sources

The Wazuh agent is a lightweight monitoring software. It is a multi-platform component that provides visibility into the endpoint’s security by collecting critical system and application logs/events. The following section explains how to install it from sources across different operating systems.

This section covers installing dependencies, downloading and compiling the source code, running the installation wizard, and uninstalling the Wazuh agent if necessary.

Installing dependencies

Before compiling Wazuh from sources, you need to install the required build tools and libraries for the destination operating system. This section covers the essential development tools, compilers, and build utilities needed to compile the Wazuh agent successfully on different platforms.

Note

You need root user privileges to run all the commands described below. Since Wazuh 3.5, an Internet connection is required to follow this process.

Note

CMake 3.12.4 is the minimal library version required to build the Wazuh agent solution.

Note

GCC 9.4 is the minimal compiler version required to build the Wazuh agent solution.

  1. Install development tools and compilers. In Linux, this can easily be done using your distribution’s package manager:

# apt-get install python3 gcc g++ make libc6-dev curl policycoreutils automake autoconf libtool libssl-dev procps build-essential

CMake 3.18 installation

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz && cd cmake-3.18.3 && ./bootstrap --no-system-curl && make -j$(nproc) && make install
# cd .. && rm -rf cmake-*

Installing the Wazuh agent

This section walks you through downloading the Wazuh source code, compiling it, and running the installation wizard to set up the Wazuh agent on your system.

  1. Download and extract the latest version:

    # curl -Ls https://github.com/wazuh/wazuh/archive/v4.14.0.tar.gz | tar zx
# cd wazuh-4.14.0

  2. If you have previously compiled for another platform, you must clean the build using the Makefile in src/:

    # make -C src clean
# make -C src clean-deps

  3. Build the Wazuh agent with gcc-14 and g++-14, this only applies to distributions with the Pacman package manager:

    # cd wazuh-4.14.0/src
# make TARGET=agent deps
# make TARGET=agent CC=gcc-14 CXX=g++-14
# cd ..

  4. Run the install.sh script. This will run a wizard that will guide you through the installation process using the Wazuh sources:

    # cd wazuh-4.14.0
# ./install.sh

    Note

    During the installation, users can decide the installation path. Execute the ./install.sh script and select the language, set the installation mode to agent, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default installation path is /var/ossec. A commonly used custom path is /opt. When choosing a different path than the default, if the directory already exists, the installer will ask to delete the directory or proceed by installing Wazuh inside it. You can also run an unattended installation.

  5. The script will ask about what kind of installation you want. Type agent to install a Wazuh agent:

    1- What kind of installation do you want (manager, agent, local, hybrid or help)? agent

Next steps

Now that the agent is installed, the next step is to enroll the agent with the Wazuh server. For more information about this process, please check the Wazuh agent enrollment section.

Uninstall

  1. To uninstall the Wazuh agent, set WAZUH_HOME with the current installation path:

    # WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

  2. Stop the service:

    # service wazuh-agent stop 2> /dev/null

  3. Stop the daemon:

    # $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

  4. Remove the installation folder and all its content:

    # rm -rf $WAZUH_HOME

  5. Delete the service:

    # [ -f /etc/rc.local ] && sed -i'' '/wazuh-control start/d' /etc/rc.local
# find /etc/{init.d,rc*.d} -name "*wazuh*" | xargs rm -f

  6. Remove Wazuh user and group:

    # userdel wazuh 2> /dev/null
# groupdel wazuh 2> /dev/null