Wazuh manager
The Wazuh manager analyzes event data received from Wazuh agents and forwards the processed events to the Wazuh indexer. It is also used to remotely manage the configurations of Wazuh agents and monitor their status. If you want to learn more about the Wazuh components, check the Getting started with Wazuh section.
You can install the Wazuh manager on a single host or distribute it across multiple nodes in a cluster configuration. Multi-node configurations provide high availability and improved performance. When combined with a network load balancer, you can achieve efficient use of its capacity.
Check the requirements below and choose an installation method to start installing the Wazuh manager.
Assisted installation: Install this component by running an assistant that automates the installation and configuration process.
Step-by-step installation: Install this component following detailed step-by-step instructions.
Requirements
Check the recommended operating systems and hardware requirements for the Wazuh manager installation. Make sure that your system environment meets all requirements and that you have root user privileges.
Recommended operating systems
The Wazuh manager requires a 64-bit Intel, AMD, or ARM Linux processor (x86_64/AMD64 or AARCH64/ARM64 architecture). Wazuh recommends the following operating system versions:
Amazon Linux 2023
Ubuntu 24.04, 26.04
Red Hat Enterprise Linux 9, 10
Hardware requirements
You can install the Wazuh manager as a single-node or multi-node cluster.
Hardware recommendations
Minimum
Recommended
Component
RAM (GB)
CPU (cores)
RAM (GB)
CPU (cores)
Wazuh manager
8
4
16
8
Disk space requirements
The Wazuh manager no longer stores alerts from monitored endpoints. Instead, it stores the content and databases required by its server-side modules. Because the Vulnerability Scanner feed requires at least 15 GB of storage, Wazuh recommends allocating at least 20 GB of disk space for a Wazuh manager.