Installing the Wazuh agent from sources

The Wazuh agent is a lightweight monitoring software. It is a multi-platform component that provides visibility into the endpoint’s security by collecting critical system and application logs/events. The following section explains how to install it from sources across different operating systems.

This section covers installing dependencies, downloading and compiling the source code, running the installation wizard, and uninstalling the Wazuh agent if necessary.

Installing dependencies

Before compiling Wazuh from sources, you need to install the required build tools and libraries for the destination operating system. This section covers the essential development tools, compilers, and build utilities needed to compile the Wazuh agent successfully on different platforms.

Note

You need root user privileges to run all the commands described below. The build downloads external dependencies, so it requires an Internet connection. Building the Wazuh agent requires GCC 13 or later and CMake 3.22.1 or later.

  1. Install the development tools and compilers with the package manager of your distribution. These commands are tested with the Wazuh 5.0.0 RC2 sources on Ubuntu 26.04, Ubuntu 24.04, CentOS Stream 10, and Amazon Linux 2023. Other systems and versions are likely to work, but we can't guarantee it.

    # apt-get update
# apt-get install gcc g++ make cmake curl procps policycoreutils

Installing the Wazuh agent

This section covers downloading the Wazuh source code, compiling it, and running the installation wizard.

  1. Download and extract the Wazuh source code:

    # curl -Ls https://github.com/wazuh/wazuh/archive/v5.0.0-rc2.tar.gz | tar zx
# cd wazuh-5.0.0-rc2

  2. If you have previously compiled for another platform, you must clean the build using the Makefile in src/:

    # make -C src clean
# make -C src clean-deps

  3. Download the external dependencies and build the Wazuh agent:

    # make -C src TARGET=agent deps
# make -C src TARGET=agent -j$(nproc)

  4. Run the install.sh script. The script starts a wizard that guides you through the installation:

    # ./install.sh

  5. When the script asks what kind of installation you want, type 2 to install the Wazuh agent:

    1- Installation type:
   1) manager
   2) agent
   Select an option [1-2]: 2

  6. When prompted, enter the IP address or hostname of the Wazuh manager.

    2- Clean install: no existing agent installation detected.
3- What's the IP Address or hostname of the Wazuh manager?: 192.168.33.149

  7. Create an enrollment token on the Wazuh manager. Replace <WAZUH_MANAGER_ADDRESS> with the IP address or hostname that the agents connect to. The address must be in the subject alternative names of the Wazuh manager certificate:

    # /var/wazuh-manager/bin/wazuh-manager-authd --create-enrollment-token --address <WAZUH_MANAGER_ADDRESS>

  8. Save the token that the command prints to a file on the endpoint, for example, /root/token. Then enroll the Wazuh agent:

    # /var/ossec/bin/wazuh-agent-auth --token-file /root/token

  9. Start the Wazuh agent and enable it to start at boot:

    # systemctl daemon-reload
# systemctl enable --now wazuh-agent

  10. On the Wazuh manager, check that the Wazuh agent is connected. The status of a connected agent is active. The password of the wazuh user is the WAZUH_MANAGER_API_PASSWORD value in /etc/wazuh-manager/export/credentials.env:

    # TOKEN=$(curl -s --cacert /etc/wazuh-manager/export/ca.pem -u wazuh:<WAZUH_PASSWORD> -X POST "https://localhost:55000/security/user/authenticate?raw=true")
# curl -s --cacert /etc/wazuh-manager/export/ca.pem -X GET "https://localhost:55000/agents?select=id,name,status,ip&pretty=true" -H "Authorization: Bearer $TOKEN"

Next steps

To learn about enrollment tokens and other enrollment methods, see the Wazuh agent enrollment section.

Uninstall

  1. To uninstall the Wazuh agent, set WAZUH_HOME to the installation path, /var/ossec by default:

    # WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

  2. Stop the service:

    # service wazuh-agent stop 2> /dev/null

  3. Stop the daemon:

    # $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

  4. Remove the installation folder and all its content:

    # rm -rf $WAZUH_HOME

  5. Delete the service:

    # [ -f /etc/rc.local ] && sed -i'' '/wazuh-control start/d' /etc/rc.local
# find /etc/{init.d,rc*.d} -name "*wazuh-agent*" | xargs rm -f

  6. Remove the wazuh user and group:

    # userdel wazuh 2> /dev/null
# groupdel wazuh 2> /dev/null