Daemons
The Wazuh platform includes several daemons that work together to collect, process, store, and manage security data.
In Wazuh 5.0 and later, the manager binaries are installed under the /var/wazuh-manager directory and use the wazuh-manager- prefix. Agent binaries retain the existing installation layout under /var/ossec.
The following sections describe the daemons available for the Wazuh manager and the Wazuh agent.
Wazuh manager daemons
The Wazuh manager includes the following daemons:
Daemon |
Description |
|---|---|
Processes, decodes, normalizes, correlates, and enriches events received from agents and other data sources. |
|
Provides the Wazuh RESTful API for managing the Wazuh platform. |
|
Handles secure enrollment and authentication of Wazuh agents. |
|
Coordinates communication and synchronization between nodes in a Wazuh cluster. |
|
Maintains the manager's local databases and provides database services to other manager components. |
|
Executes manager modules such as vulnerability detection and other integrated services. |
|
Monitors manager files and performs maintenance tasks such as log rotation and housekeeping. |
|
Receives events from Wazuh agents and forwards them to the Wazuh manager for processing. |
Wazuh agent daemons
The Wazuh agent includes the following daemons:
Daemon |
Description |
|---|---|
Manages communication between the agent and the Wazuh manager. |
|
Executes active response commands triggered by security events. |
|
Collects logs from configured sources and forwards them for analysis. |
|
Executes agent-side modules and scheduled tasks. |
|
Performs file integrity monitoring (FIM) by monitoring changes to configured files and directories. |