Install Wazuh agents on hosts without Internet access

The wazuh-offline.tar.gz file doesn't include the Wazuh agent. On the system with Internet access, download the Wazuh agent package for each endpoint from Packages list, and copy it to the endpoint. Create an enrollment token on the Wazuh manager, as Generate the enrollment token describes. In the following commands, replace <ENROLLMENT_TOKEN> with the token and <AGENT_NAME> with a name that no other agent uses. Use the file name of the package you downloaded.

For the graphical installers, the deployment variables, and troubleshooting, see the Linux, Windows, and macOS agent pages.

Linux

  1. Install the package as root, from the directory that holds it:

    # WAZUH_ENROLLMENT_TOKEN='<ENROLLMENT_TOKEN>' WAZUH_AGENT_NAME='<AGENT_NAME>' dpkg -i ./wazuh-agent_5.0.0-rc2_amd64.deb

  2. Enable and start the Wazuh agent:

    # systemctl daemon-reload
# systemctl enable --now wazuh-agent

Windows

  1. Run one of the following commands as an administrator, from the directory that holds the installer:

    > start /wait wazuh-agent-5.0.0-rc2.msi /q WAZUH_ENROLLMENT_TOKEN="<ENROLLMENT_TOKEN>" WAZUH_AGENT_NAME="<AGENT_NAME>"

  2. Start the Wazuh agent:

    > NET START WazuhSvc

macOS

  1. Run the command for your architecture as root, from the directory that holds the package. The command saves the token in /tmp/wazuh_envs, and the installer deletes that file when it finishes.

    # (umask 077 && echo "WAZUH_ENROLLMENT_TOKEN='<ENROLLMENT_TOKEN>'" > /tmp/wazuh_envs && echo "WAZUH_AGENT_NAME='<AGENT_NAME>'" >> /tmp/wazuh_envs) && installer -pkg wazuh-agent-5.0.0-rc2.intel64.pkg -target /

  2. Start the Wazuh agent:

    # launchctl bootstrap system /Library/LaunchDaemons/com.wazuh.agent.plist