Installing the Wazuh manager from sources

The Wazuh manager is the core component of the Wazuh server that processes and analyzes security data from Wazuh agents and other sources. It includes the analysis engine for log processing, rule evaluation, and alert generation, along with services for the Wazuh agent enrollment and connection.

This section covers installing dependencies, downloading and compiling the source code, running the installation wizard, and uninstalling the manager if needed.

Installing dependencies

Before compiling Wazuh from sources, install the build tools for your operating system. The build requires GCC 13 or later and CMake 3.22.1 or later. These commands are tested with the Wazuh 5.0.0 RC2 sources on Ubuntu 26.04, Ubuntu 24.04, CentOS Stream 10, and Amazon Linux 2023. Other systems and versions are likely to work, but we can't guarantee it.

Ubuntu 24.04 and Ubuntu 26.04

# apt-get update
# apt-get install gcc g++ make cmake curl procps policycoreutils

Installing the Wazuh manager

This section covers downloading the Wazuh source code, compiling it, and running the installation wizard.

Install the Wazuh indexer from packages first, as the Installation guide describes. The Wazuh manager needs its password and certificates to start.

  1. Download and extract the Wazuh source code:

    # curl -Ls https://github.com/wazuh/wazuh/archive/v5.0.0-rc2.tar.gz | tar zx
# cd wazuh-5.0.0-rc2

  2. If you have previously compiled for another platform, clean the build using the Makefile in src/:

    # make -C src clean
# make -C src clean-deps

  3. Download the external dependencies and build the Wazuh manager. The build takes several minutes:

    # make -C src TARGET=manager deps
# make -C src TARGET=manager -j$(nproc)

  4. Create the /etc/wazuh-manager/local.env file:

    # install -d -m 0750 /etc/wazuh-manager
# install -m 0600 /dev/null /etc/wazuh-manager/local.env

    If the Wazuh indexer runs on another host, add the password of its wazuh-manager user. The password is the WAZUH_INDEXER_MANAGER_PASSWORD value in /etc/wazuh-indexer/export/credentials.env on a Wazuh indexer node. Replace <WAZUH_INDEXER_MANAGER_PASSWORD> with it:

    # echo "WAZUH_INDEXER_MANAGER_PASSWORD=<WAZUH_INDEXER_MANAGER_PASSWORD>" >> /etc/wazuh-manager/local.env

    If Wazuh agents reach this node through an address it doesn't have, such as a load balancer or a NAT address, add WAZUH_MANAGER_REMOTED_CERT_SANS. Include this node's own address too, because the list replaces the addresses the installer discovers:

    # echo "WAZUH_MANAGER_REMOTED_CERT_SANS=DNS:<LOAD_BALANCER_NAME>,IP:<NODE_IP>" >> /etc/wazuh-manager/local.env

  5. Run the install.sh script. The script starts a wizard that guides you through the installation:

    # ./install.sh

  6. When the script asks what kind of installation you want, type 1 to install the Wazuh manager:

    1- Installation type:
   1) manager
   2) agent
   Select an option [1-2]: 1

  7. If the Wazuh indexer runs on another host, copy ca.pem, manager-client.pem, and manager-client-key.pem from /etc/wazuh-indexer/export on a Wazuh indexer node. Then place them in /etc/wazuh-manager/certs:

    # install -m 0640 -o root -g wazuh-manager ca.pem /etc/wazuh-manager/certs/indexer-ca.pem
# install -m 0640 -o root -g wazuh-manager manager-client.pem /etc/wazuh-manager/certs/indexer-connector.pem
# install -m 0640 -o root -g wazuh-manager manager-client-key.pem /etc/wazuh-manager/certs/indexer-connector-key.pem

  8. If the Wazuh indexer runs on another host, edit the <indexer> block in /etc/wazuh-manager/wazuh-manager.conf. Replace 127.0.0.1 with the IP address of the Wazuh indexer:

    <indexer>
  <hosts>
    <host>https://<WAZUH_INDEXER_IP_ADDRESS>:9200</host>
  </hosts>

  9. The installer doesn't start the Wazuh manager. Start the Wazuh manager and enable it to start at boot:

    # systemctl daemon-reload
# systemctl enable --now wazuh-manager

    Run the following command to check that the Wazuh manager daemons are running:

    # /var/wazuh-manager/bin/wazuh-manager-control status

    If the Wazuh manager doesn't start, run journalctl -u wazuh-manager. The start-up check lists each missing or invalid password and certificate. To check the files without starting the Wazuh manager, run /var/wazuh-manager/bin/wazuh-manager-resolve-credentials --check. It prints check: no problem found when there is none, but it doesn't check the indexer password.

Installing other Wazuh components

After you install the Wazuh manager, install the Wazuh dashboard from packages, as the Installation guide describes. The Wazuh dashboard isn't available for installation from sources.

Uninstall

This section provides instructions for completely removing the Wazuh manager installation from your system.

  1. To uninstall the Wazuh manager, set WAZUH_HOME to the installation path, /var/wazuh-manager by default. The configuration is in /etc/wazuh-manager, which the last step removes:

    # WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

  2. Stop the service:

    # service wazuh-manager stop 2> /dev/null

  3. Stop the daemon:

    # $WAZUH_HOME/bin/wazuh-manager-control stop 2> /dev/null

  4. Remove the installation folder and all its content:

    # rm -rf $WAZUH_HOME

  5. Delete the service:

    # [ -f /etc/rc.local ] && sed -i'' '/wazuh-manager-control start/d' /etc/rc.local
# find /etc/{init.d,rc*.d} -name "*wazuh-manager*" | xargs rm -f

  6. Remove the wazuh-manager user and group:

    # userdel wazuh-manager 2> /dev/null
# groupdel wazuh-manager 2> /dev/null

    Remove the Wazuh manager configuration directory. It holds the CA private key that the Wazuh agents trust, so back up /etc/wazuh-manager/ca first if you plan to reinstall:

    # rm -rf /etc/wazuh-manager