Wazuh agent local configuration (ossec.conf)

The ossec.conf file is the main local configuration file for the Wazuh agent. Its location depends on the operating system:

Linux: /var/ossec/etc/ossec.conf
macOS: /Library/Ossec/etc/ossec.conf
Windows: C:\Program Files (x86)\ossec-agent\ossec.conf

The file uses XML syntax. All configuration sections must be defined within the top-level <ossec_config> element. It is recommended to back up this file before making changes to it. A configuration error may prevent Wazuh services from starting up.

The following example shows the placement of the <client> section:

<ossec_config>
  <client>
    <!-- Client configuration options -->
  </client>
</ossec_config>

You can define multiple <ossec_config> elements in the file. When the same option is defined more than once, a later definition may override an earlier one.

Use ossec.conf to configure an individual agent locally. To distribute supported configuration settings centrally, use the agent.conf file for the agent group. See centralized configuration.

Configuration sections	Description
active-response	Controls whether the agent executes Active Response commands and configures repeated- offender timeouts.
agent-upgrade	Configures remote agent upgrade behavior and WPK certificate validation.
anti_tampering	Requires Wazuh manager validation before uninstalling the agent package on supported Linux systems.
client	Configures the agent connection, reconnection, enrollment, and communication settings.
client_buffer	Controls agent-side event buffering and transmission rate limits.
github	Collects GitHub organization audit events.
labels	Adds custom agent metadata to generated events.
localfile	Configures collection from log files, event channels, journald, macOS ULS, and command output.
logging	Configures the agent internal log output format.
ms-graph	Collects logs through the Microsoft Graph API.
office365	Collects Microsoft 365 audit logs through the Office 365 Management Activity API.
rootcheck	Configures rootkit, trojan, system anomaly, and policy checks.
sca	Configures Security Configuration Assessment scans and policies.
socket	Defines custom output sockets for collected events.
syscheck	Configures file integrity monitoring and Windows registry monitoring.
wodle name="aws-s3"	Collects logs from supported AWS buckets, services, and subscribers.
wodle name="azure-logs"	Collects logs from Azure Log Analytics, Microsoft Graph, and Azure Storage.
wodle name="command"	Executes scheduled commands and collects their output.
wodle name="docker-listener"	Monitors Docker container events.
wodle name="syscollector"	Collects system inventory data.
gcp-pubsub	Collects logs from a Google Cloud Pub/Sub subscription.
gcp-bucket	Collects access logs from Google Cloud Storage buckets.