Wazuh manager

The Wazuh manager analyzes event data received from Wazuh agents and forwards the processed events to the Wazuh indexer. It is also used to remotely manage the configurations of Wazuh agents and monitor their status.

You can install the Wazuh manager on a single host or distribute it across multiple nodes in a cluster configuration. Multi-node configurations provide high availability and improved performance. When combined with a network load balancer, you can achieve efficient use of its capacity.

Check the requirements below and choose an installation method to start installing the Wazuh manager.

1
2
3

Install the Wazuh indexer

../../_images/Indexer-Circle.png

Install the Wazuh manager

../../_images/Server-Circle.png

Install the Wazuh dashboard

../../_images/Dashboard-noBG.png

Requirements

Check the recommended operating systems and hardware requirements for the Wazuh manager installation. Make sure that your system environment meets all requirements and that you have root user privileges.

Hardware requirements

You can install the Wazuh manager as a single-node or multi-node cluster.

  • Hardware recommendations

    Minimum

    Recommended

    Component

    RAM (GB)

    CPU (cores)

    RAM (GB)

    CPU (cores)

    Wazuh manager

    4

    8

    8

    16

  • Disk space requirements

    The amount of data depends on the generated alerts per second (APS). This table details the estimated disk space needed per agent to store 90 days of alerts on a Wazuh manager, depending on the type of monitored endpoints.

    Monitored endpoints

    APS
    Storage in Wazuh manager
    (GB/90 days)

    Servers

    0.25

    0.1

    Workstations

    0.1

    0.04

    Network devices

    0.5

    0.2

    For example, for an environment with 80 workstations, 10 servers, and 10 network devices, the storage needed on the Wazuh manager for 90 days of alerts is 6 GB.