Wazuh manager
The Wazuh manager analyzes event data received from Wazuh agents and forwards the processed events to the Wazuh indexer. It is also used to remotely manage the configurations of Wazuh agents and monitor their status. If you want to learn more about the Wazuh components, check the Getting started section. The Wazuh manager doesn't monitor its own host. To monitor it, install a Wazuh agent on the same host and enroll it with a token for the host's own address.
You can install the Wazuh manager on a single host or distribute it across multiple nodes in a cluster configuration. Multi-node configurations provide high availability and improved performance when Wazuh agents connect through a network load balancer. Each Wazuh agent connects to one address only, as Agent connection address describes.
Check the requirements below and choose an installation method to start installing the Wazuh manager.
Assisted installation: Install this component by running an assistant that automates the installation and configuration process.
Step-by-step installation: Install this component following detailed step-by-step instructions.
Requirements
Check the recommended operating systems and hardware requirements for the Wazuh manager installation. Make sure that your system environment meets all requirements and that you have root user privileges.
The Wazuh manager package doesn't install on a host that has a Wazuh manager 4.x, even a fresh one: migrate instead. The Wazuh manager doesn't start until it has the Wazuh indexer password and certificates.
Recommended operating systems
The Wazuh manager requires a 64-bit Intel, AMD, or ARM Linux processor (x86_64/AMD64 or AARCH64/ARM64 architecture). Wazuh recommends the following operating system versions:
Amazon Linux 2023
Ubuntu 24.04, 26.04
Red Hat Enterprise Linux 9, 10
Hardware requirements
You can install the Wazuh manager as a single-node or multi-node cluster.
Hardware requirements for each node:
Minimum
Recommended
Component
RAM (GB)
CPU (cores)
RAM (GB)
CPU (cores)
Wazuh manager
8
4
16
8
An all-in-one host runs the Wazuh indexer, Wazuh manager, and Wazuh dashboard together. For up to 25 agents, it needs 4 CPU cores and 8 GB of RAM, as in the Quickstart. Two or more Wazuh central components on one host need at least 8 GB of RAM and 4 CPU cores.
Disk space requirements
The Wazuh manager no longer stores alerts from monitored endpoints. Instead, it stores the content and databases required by its server-side modules. The Vulnerability Scanner feed needs at least 15 GB of storage, so give a Wazuh manager at least 20 GB of disk space.
Required ports
The Wazuh manager uses the following ports.
Port |
From |
Purpose |
|---|---|---|
1517/TCP |
Wazuh 5.x agents, load balancer |
Agent enrollment and connection over HTTPS |
1516/TCP |
Other Wazuh manager nodes |
Cluster communication, multi-node only |
55000/TCP |
Wazuh dashboard, API clients, and agents removing themselves under anti-tampering |
Wazuh manager API, master node |
1514/TCP |
Wazuh 4.x agents |
Legacy agent connection |
1515/TCP |
Wazuh 4.x agents |
Legacy enrollment |
9200/TCP, outbound |
This Wazuh manager |
Connection to the Wazuh indexer |
If no Wazuh 4.x agents connect to this Wazuh manager, you can keep 1514 and 1515 closed. You can also disable them in /etc/wazuh-manager/wazuh-manager.conf with <remote><legacy><enabled> and <auth><disabled>.
The Wazuh manager API listens on 55000/TCP of the master node. After the Quickstart, and after an offline all-in-one installation with the installation assistant, it listens only on 127.0.0.1 and ::1. After the assisted and step-by-step installations of this guide, it listens on all network interfaces. To restrict it, set host in /var/wazuh-manager/api/configuration/api.yaml and restart the Wazuh manager.
Agent connection address
Wazuh agents connect to a Wazuh manager node only through an address in its agent listener certificate, remoted.pem. You can create enrollment tokens only for those addresses. To add an address, such as a load balancer, a NAT address, or a public name, follow your installation method:
Assisted installation: The certificate lists the node's name and its addresses from
config.yml. To add an address, use-as <ALTERNATE_ADDRESS>when you generate the configuration files. The tool adds it to the certificate of every Wazuh manager node.Step-by-step installation: The certificates tool issues the certificate with the node's name and its addresses from
config.yml. To add an address, use-as <ALTERNATE_ADDRESS>when you create the certificates. The root CA must be in place before you install the package, as Deploying certificates and passwords describes.
In both methods, pass every address in the same run, because the certificate holds only the -as values of that run. For a cluster behind a load balancer, use a TCP passthrough load balancer on 1517/TCP. Add its address to the certificate of every Wazuh manager node. Create enrollment tokens on the master node. A worker node refuses the command, and the master node accepts only addresses in its own certificate. Agents therefore enroll through the load balancer or the master node's address. To create a token for a worker node's address, add that address with -as too.
A Wazuh agent connects to one address only: the address of its enrollment token, saved as <agent><manager><endpoint> in ossec.conf. It doesn't switch to another node if that node stops. In a Wazuh manager cluster, an agent enrolled with a token for the master node's address sends all its data to the master node. To spread agents across the nodes and keep them connected when a node stops, use a load balancer as described above. Without a load balancer, add the address of each worker node with -as, and create tokens for the worker addresses on the master node. To see which node processes an agent's data, check the wazuh.cluster.node field of its events.