Installing Wazuh agent from sources

Note

All the commands described below need to be executed with root user privileges. Since Wazuh 3.5 it is necessary to have internet connection when following this process.

Note

CMake 3.12.4 is the minimal library version required to build the Wazuh agent solution.

  1. Install development tools and compilers. In Linux this can easily be done using your distribution’s package manager:

# yum update
# yum install make gcc gcc-c++ policycoreutils-python automake autoconf libtool centos-release-scl openssl-devel
# yum update
# yum install devtoolset-7
# scl enable devtoolset-7 bash

CMake 3.18 installation

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz
# cd cmake-3.18.3 && ./bootstrap --no-system-curl
# make -j$(nproc) && make install
# cd .. && rm -rf cmake-*
# yum install make gcc gcc-c++ python3 python3-policycoreutils automake autoconf libtool openssl-devel cmake
# rpm -i $(rpm --eval https://packages.wazuh.com/utils/libstdc%2B%2B/libstdc%2B%2B-static-8.4.1-1.el8.'%{_arch}'.rpm)

Optional CMake 3.18 installation from sources

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz
# cd cmake-3.18.3 && ./bootstrap --no-system-curl
# make -j$(nproc) && make install
# cd .. && rm -rf cmake-*
# export PATH=/usr/local/bin:$PATH
# apt-get install python gcc g++ make libc6-dev curl policycoreutils automake autoconf libtool

CMake 3.18 installation

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz
# cd cmake-3.18.3 && ./bootstrap --no-system-curl
# make -j$(nproc) && make install
# cd .. && rm -rf cmake-*
# zypper install make gcc gcc-c++ policycoreutils-python automake autoconf libtool

CMake 3.18 installation

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz
# cd cmake-3.18.3 && ./bootstrap --no-system-curl
# make -j$(nproc) && make install
# cd .. && rm -rf cmake-*

Note

For Suse 11, it is possible that some of the tools are not found in the package manager, in that case you can add the following official repository:

# zypper addrepo http://download.opensuse.org/distribution/11.4/repo/oss/ oss
  1. Download and extract the latest version:

# curl -Ls https://github.com/wazuh/wazuh/archive/v4.2.4.tar.gz | tar zx
  1. Run the install.sh script. This will run a wizard that will guide you through the installation process using the Wazuh sources:

# cd wazuh-*
# ./install.sh

If you have previously compiled for another platform, you must clean the build using the Makefile in src:

# cd wazuh-*
# make -C src clean
# make -C src clean-deps

Note

During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to agent, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt. When choosing a different path than the default, if the directory already exist the installer will ask if delete the directory or if installing Wazuh inside. You can also run an unattended installation.

  1. The script will ask about what kind of installation you want. Type agent in order to install a Wazuh agent:

1- What kind of installation do you want (manager, agent, local, hybrid or help)? agent

Now that the agent is installed, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit the document: user manual.

Uninstall

To uninstall Wazuh agent, set WAZUH_HOME with the current installation path:

# WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

Stop the service:

# service wazuh-agent stop 2> /dev/null

Stop the daemon:

# $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

Remove the installation folder and all its content:

# rm -rf $WAZUH_HOME

Delete the service:

For SysV Init:

# [ -f /etc/rc.local ] && sed -i'' '/wazuh-control start/d' /etc/rc.local
# find /etc/{init.d,rc*.d} -name "*wazuh*" | xargs rm -f

For Systemd:

# find /etc/systemd/system -name "wazuh*" | xargs rm -f
# systemctl daemon-reload

Remove users:

# userdel ossec 2> /dev/null
# userdel ossecm 2> /dev/null
# userdel ossecr 2> /dev/null
# groupdel ossec 2> /dev/null

Note

The following procedure has been tested on Ubuntu 16.04 and other Debian based distributions and may work with other Debian/Ubuntu versions as well.

  1. Set up the Ubuntu build environment. Install these dependencies to build the Windows Wazuh agent installer on Ubuntu:

# apt-get install gcc-mingw-w64 g++-mingw-w64-i686 g++-mingw-w64-x86-64 nsis make cmake
  1. Set up Windows build environment. To generate the installer, the following dependencies must be in place on the Windows machine:

  • WiX Toolset.

  • .NET framework 3.5.1.

  • Microsoft Windows SDK.

  1. Download the Wazuh source code and unzip it:

# curl -Ls https://github.com/wazuh/wazuh/archive/v4.2.4.tar.gz | tar zx
# cd wazuh-4.2.4/src
  1. Compile the Agent by running the make command:

# make deps TARGET=winagent
# make TARGET=winagent

The following output will appear at the end of the building process:

Done building winagent
  1. Moves the entire repository to the Windows machine. It is recommended to compress it to speed up the process.

# zip -r wazuh.zip ../../wazuh-4.2.4
  1. Decompress the repository on the Windows machine, run the wazuh-installer-build-msi.bat script from the win32 folder.

cd wazuh-4.2.4\src\win32
.\wazuh-installer-build-msi.bat

If you do not want to sign the installer, you will have to comment or delete the signtool line in the previous script.

:: signtool sign /a /tr http://rfc3161timestamp.globalsign.com/advanced /d "%MSI_NAME%" /td SHA256 "%MSI_NAME%"

Note

Once the Agent is deployed with a normal or unattended installation, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit user manual.

Uninstall

To uninstall the agent, the original MSI file will be needed to perform the unattended process:

msiexec.exe /x wazuh-agent-4.2.4-1.msi /qn
  1. Install development tools and compilers. In macOS, this can be easily done by installing brew, a package manager for macOS:

$ /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
$ brew install automake autoconf libtool cmake
  1. Download and extract the latest version:

$ curl -Ls https://github.com/wazuh/wazuh/archive/v4.2.4.tar.gz | tar zx

Note

All the commands described below need to be executed with root user privileges.

  1. Run the install.sh script. This will run a wizard that will guide you through the installation process using the Wazuh sources:

# cd wazuh-*
# USER_DIR="/Library/Ossec" ./install.sh

Note

Note that with the variable USER_DIR it has been indicated that the agent installation path is /Library/Ossec

If you have previously compiled for another platform, you must clean the build using the Makefile in src:

# cd wazuh-*
# make -C src clean
# make -C src clean-deps

Note

During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to agent, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt. When choosing a different path than the default, if the directory already exist the installer will ask if delete the directory or if installing Wazuh inside. You can also run an unattended installation.

Note

Since Wazuh 3.5 it is necessary to have internet connection when following this step.

  1. The script will ask about what kind of installation you want. Type agent in order to install a Wazuh agent:

1- What kind of installation do you want (manager, agent, local, hybrid or help)? agent

Now that the agent is installed, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit the document: user manual.

Uninstall

To uninstall Wazuh agent, set WAZUH_HOME with the current installation path:

# WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

Stop the service:

# service wazuh-agent stop 2> /dev/null

Stop the daemon:

# $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

Remove the installation folder and all its content:

# rm -rf $WAZUH_HOME

Delete the service:

# rm -rf /Library/StartupItems/OSSEC

Remove users:

# dscl . -delete "/Users/ossec" > /dev/null 2>&1
# dscl . -delete "/Users/ossecm" > /dev/null 2>&1
# dscl . -delete "/Users/ossecr" > /dev/null 2>&1
# dscl . -delete "/Groups/ossec" > /dev/null 2>&1

Note

All the commands described below need to be executed with root user privileges. Since Wazuh 3.5 it is necessary to have internet connection when following this process.

  1. Install development tools and compilers.

1.1 Download the wget tool.

# rpm -Uvh --nodeps http://www.oss4aix.org/download/RPMS/wget/wget-1.19.2-1.aix5.1.ppc.rpm

1.2 Download the following script

# wget https://raw.githubusercontent.com/wazuh/wazuh-packages/master/aix/generate_wazuh_packages.sh --no-check-certificate

Note

If you can’t download the script this way, then you should copy it through the scp utility.

1.3 Install the necessary dependencies using the script.

# chmod +x generate_wazuh_packages.sh
# ./generate_wazuh_packages.sh -e

Note

This step may take a few minutes.

  1. Download the latest version.

# wget -O wazuh.tar.gz --no-check-certificate https://api.github.com/repos/wazuh/wazuh/tarball/v4.2.4 && gunzip -c wazuh.tar.gz | tar -xvf -

Note

If you can’t download the repository this way, then you should copy it through the scp utility.

  1. Compile the sources.

# cd wazuh-*
# gmake -C src deps RESOURCES_URL=https://packages.wazuh.com/deps/4.2
# gmake -C src TARGET=agent USE_SELINUX=no PREFIX=/var/ossec
  1. Run the install.sh script. This will run a wizard that will guide you through the installation process using the Wazuh sources:

# ./install.sh

If you have previously compiled for another platform, you must clean the build using the Makefile in src:

# gmake -C src clean-deps
# gmake -C src clean

Note

During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to agent, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt. When choosing a different path than the default, if the directory already exist the installer will ask if delete the directory or if installing Wazuh inside. You can also run an unattended installation.

  1. Finally apply the following configuration:

# sed '/System inventory/,/^$/{/^$/!d;}' /var/ossec/etc/ossec.conf > /var/ossec/etc/ossec.conf.tmp
# mv /var/ossec/etc/ossec.conf.tmp /var/ossec/etc/ossec.conf

Note

Note that the above commands have been executed for the default installation path /var/ossec. If you have installed the agent in another path, you will have to modify the path of those commands.

Now that the agent is installed, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit the document: user manual.

Uninstall

To uninstall Wazuh agent, set WAZUH_HOME with the current installation path:

# WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

Stop the service:

# service wazuh-agent stop 2> /dev/null

Stop the daemon:

# $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

Remove the installation folder and all its content:

# rm -rf $WAZUH_HOME

Delete the service:

# find /etc/rc.d -name "*wazuh*" | xargs rm -f

Remove users:

# userdel ossec 2> /dev/null
# userdel ossecm 2> /dev/null
# userdel ossecr 2> /dev/null
# groupdel ossec 2> /dev/null

Note

All the commands described below need to be executed with root user privileges. Since Wazuh 3.5 it is necessary to have internet connection when following this process.

  1. Install development tools and compilers.

1.1 Download the depothelper-2.10-hppa_32-11.31.depot file.

# /usr/local/bin/wget https://github.com/wazuh/wazuh-packages/raw/master/hp-ux/depothelper-2.10-hppa_32-11.31.depot --no-check-certificate

Note

If you can’t download the script this way, then you should copy it through the scp utility.

1.2 Install the package manager.

# swinstall -s depothelper-2.10-hppa_32-11.31.depot \*

1.3 Download the wget tool (If it is not installed).

# /usr/local/bin/depothelper -f wget

1.4 Download the following script

# /usr/local/bin/wget https://raw.githubusercontent.com/wazuh/wazuh-packages/master/hp-ux/generate_wazuh_packages.sh --no-check-certificate

Note

If you can’t download the script this way, then you should copy it through the scp utility.

1.5 Install the necessary dependencies using the script.

# chmod +x generate_wazuh_packages.sh
# ./generate_wazuh_packages.sh -e

Note

This step may take a long time.

  1. Download the latest version.

# /usr/local/bin/curl -k -L -O https://github.com/wazuh/wazuh/archive/v4.2.4.zip && /usr/local/bin/unzip v4.2.4

Note

If you can’t download the repository this way, then you should copy it through the scp utility.

  1. Compile the sources.

# cd wazuh-*
# /usr/local/bin/gmake -C src deps RESOURCES_URL=https://packages.wazuh.com/deps/4.2/
# /usr/local/bin/gmake -C src TARGET=agent USE_SELINUX=no
  1. Run the install.sh script. This will run a wizard that will guide you through the installation process using the Wazuh sources:

# ./install.sh

If you have previously compiled for another platform, you must clean the build using the Makefile in src:

# /usr/local/bin/gmake -C src clean-deps
# /usr/local/bin/gmake -C src clean

Note

During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to agent, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt. When choosing a different path than the default, if the directory already exist the installer will ask if delete the directory or if installing Wazuh inside. You can also run an unattended installation.

Now that the agent is installed, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit the document: user manual.

Uninstall

To uninstall Wazuh agent, set WAZUH_HOME with the current installation path:

# WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

Stop the service:

# service wazuh-agent stop 2> /dev/null

Stop the daemon:

# $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

Remove the installation folder and all its content:

# rm -rf $WAZUH_HOME

Delete the service:

# find /sbin/{init.d,rc*.d} -name "*wazuh*" | xargs rm -f

Remove users:

# userdel ossec 2> /dev/null
# userdel ossecm 2> /dev/null
# userdel ossecr 2> /dev/null
# groupdel ossec 2> /dev/null

This section describes how to download and build the Wazuh HIDS Solaris agent from sources for the following versions:

  • For Solaris i386

  • For Solaris SPARC

Note

All the commands described below need to be executed with root user privileges. Since Wazuh 3.5 it is necessary to have internet connection when following this process.

  1. Install development tools and compilers.

1.1 Install pkgutil.

# PATH="${PATH}:/usr/sbin:/usr/bin:/usr/sbin/:/opt/csw/gnu/:/usr/sfw/bin/:/opt/csw/bin/"
# export PATH
# pkgadd -d http://get.opencsw.org/now

1.2 Install the following tools:

# /opt/csw/bin/pkgutil -y -i git automake gmake cmake autoconf libtool wget curl gcc5core gcc5g++

1.3 Download and build the gcc/g++ 5.5 compiler:

# curl -k -O https://packages.wazuh.com/utils/gcc/gcc-5.5.0/gcc-5.5.0.tar.gz && gtar xzf gcc-5.5.0.tar.gz
# ln -sf gcc-5.5.0 gcc
# cd gcc
# wget https://packages.wazuh.com/utils/gcc/mpfr-2.4.2.tar.bz2 && gtar xjf mpfr-2.4.2.tar.bz2 && ln -sf mpfr-2.4.2 mpfr
# wget https://packages.wazuh.com/utils/gcc/gmp-4.3.2.tar.bz2 && gtar xjf gmp-4.3.2.tar.bz2 && ln -sf gmp-4.3.2 gmp
# wget https://packages.wazuh.com/utils/gcc/mpc-0.8.1.tar.gz && gtar xzf mpc-0.8.1.tar.gz && ln -sf mpc-0.8.1 mpc
# wget https://packages.wazuh.com/utils/gcc/isl-0.14.tar.bz2 && gtar xjf isl-0.14.tar.bz2 && ln -sf isl-0.14 isl
# cd .. && mkdir -p gcc-build && cd gcc-build
# ../gcc/configure --prefix=/usr/local/gcc-5.5.0 --enable-languages=c,c++ --disable-multilib --disable-libsanitizer --disable-bootstrap --with-gnu-as --with-as=/opt/csw/bin/gas
# gmake
# gmake install
# echo "export PATH=/usr/local/gcc-5.5.0/bin:${PATH}" >> /etc/profile
# PATH="/usr/local/gcc-5.5.0/bin:${PATH}"
# export PATH
# CPLUS_INCLUDE_PATH=/usr/local/gcc-5.5.0/include/c++/5.5.0/
# export CPLUS_INCLUDE_PATH
# LD_LIBRARY_PATH=/usr/local/gcc-5.5.0/lib/
# export LD_LIBRARY_PATH
# cd .. && rm -rf gcc-build && rm -rf gcc-5.5.0.tar.gz
# rm -rf mpfr-2.4.2.tar.bz2 && rm -rf gmp-4.3.2.tar.bz2 && rm -rf mpc-0.8.1.tar.gz && rm -rf isl-0.14.tar.bz2

Note

The gmake step will take several minutes to complete. This is a normal behavior.

1.4 Install cmake library:

# curl -k -O -L https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && gtar xzf cmake-3.18.3.tar.gz
# ln -sf cmake-3.18.3 cmake
# cd cmake && ./bootstrap
# gmake
# gmake install
# PATH="/usr/local/bin/:${PATH}"
# export PATH
# cd .. && rm -rf cmake-*
  1. Download the latest version and a necessary file.

# /opt/csw/bin/git clone -b v4.2.4 https://github.com/wazuh/wazuh.git
# wget -P wazuh https://raw.githubusercontent.com/wazuh/wazuh-packages/master/solaris/solaris10/solaris10_patch.sh
  1. Create an user and group called ossec needed for installation.

# groupadd ossec
# useradd -g ossec ossec
  1. Run the following commands to update the makefile

# mv wazuh/src/Makefile wazuh/src/Makefile.tmp
# sed -n '/OSSEC_LDFLAGS+=-z relax=secadj/!p' wazuh/src/Makefile.tmp > wazuh/src/Makefile
  1. Compile the sources files.

  • For Solaris 10 i386:

# cd wazuh/src
# gmake clean
# gmake deps
# gmake -j 4 TARGET=agent PREFIX=/var/ossec USE_SELINUX=no
  • For Solaris 10 SPARC:

# cd wazuh/src
# gmake clean
# gmake deps
# gmake -j 4 TARGET=agent PREFIX=/var/ossec USE_SELINUX=no USE_BIG_ENDIAN=yes
  1. Run the solaris10_patch.sh that has previously been downloaded.

# cd ../
# chmod +x solaris10_patch.sh
# ./solaris10_patch.sh
  1. Run the install.sh script. This will run a wizard that will guide you through the installation process using the Wazuh sources:

# ./install.sh

If you have previously compiled for another platform, you must clean the build using the Makefile in src:

# gmake -C src clean
# gmake -C src clean-deps

Note

During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to agent, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt. When choosing a different path than the default, if the directory already exist the installer will ask if delete the directory or if installing Wazuh inside. You can also run an unattended installation.

  1. The script will ask about what kind of installation you want. Type agent in order to install a Wazuh agent:

1- What kind of installation do you want (manager, agent, local, hybrid or help)? agent

Now that the agent is installed, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit the document: user manual.

Uninstall

To uninstall Wazuh agent, set WAZUH_HOME with the current installation path:

# WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

Stop the service:

# service wazuh-agent stop 2> /dev/null

Stop the daemon:

# $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

Remove the installation folder and all its content:

# rm -rf $WAZUH_HOME

Delete the service:

# find /sbin/{init.d,rc*.d} -name "*wazuh*" | xargs rm -f

Remove users:

# userdel ossec 2> /dev/null
# userdel ossecm 2> /dev/null
# userdel ossecr 2> /dev/null
# groupdel ossec 2> /dev/null

Note

All the commands described below need to be executed with root user privileges. Since Wazuh 3.5 it is necessary to have internet connection when following this process.

  1. Install development tools and build the needed compilers.

1.1 Install pkgutil an update it.

# pkgadd -d http://get.opencsw.org/now
# export PATH="${PATH}:/usr/sfw/bin:/opt/csw/bin:/opt/ccs/bin"
# pkgutil -y -U

1.2 Install python 2.7

# /opt/csw/bin/pkgutil -y -i python27
# ln -sf /opt/csw/bin/python2.7 /usr/bin/python

1.3 Install the following tools:

# pkgutil -y -i git gmake cmake gcc5core gcc5g++

1.4 Install a gcc version to include all files needed in the next step:

# pkg install gcc-45

1.5 Download and build the gcc/g++ 5.5 compiler:

# curl -O https://packages.wazuh.com/utils/gcc/gcc-5.5.0/gcc-5.5.0.tar.gz && gtar xzf gcc-5.5.0.tar.gz
# ln -sf gcc-5.5.0 gcc
# cd gcc && ./contrib/download_prerequisites
# cd .. && mkdir -p gcc-build && cd gcc-build
# ../gcc/configure --prefix=/usr/local/gcc-5.5.0 --enable-languages=c,c++ --disable-multilib --disable-libsanitizer --disable-bootstrap --with-ld=/usr/ccs/bin/ld --without-gnu-ld --with-gnu-as --with-as=/opt/csw/bin/gas
# gmake
# gmake install
# export PATH=/usr/local/gcc-5.5.0/bin/:/usr/local/bin/:/usr/bin/:/usr/sbin/:$PATH
# export CPLUS_INCLUDE_PATH=/usr/local/gcc-5.5.0/include/c++/5.5.0/
# export LD_LIBRARY_PATH=/usr/local/gcc-5.5.0/lib/
# cd ..

Note

The gmake step will take several minutes to complete. This is a normal behavior.

1.6 Install cmake library:

# curl -O -L https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && gtar xzf cmake-3.18.3.tar.gz
# ln -sf cmake-3.18.3 cmake
# cd cmake && ./bootstrap
# gmake
# gmake install
# cd .. && rm -rf cmake-*
  1. Download the latest version.

# git clone -b v4.2.4 https://github.com/wazuh/wazuh.git

Note

If you can’t download the file due to an Open SSL error, then you should copy the directory with the scp utility.

  1. Run the install.sh script. This will run a wizard that will guide you through the installation process using the Wazuh sources:

# cd wazuh*
# ./install.sh

If you have previously compiled for another platform, you must clean the build using the Makefile in src:

# gmake -C src clean
# gmake -C src clean-deps

Note

During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to agent, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt. When choosing a different path than the default, if the directory already exist the installer will ask if delete the directory or if installing Wazuh inside. You can also run an unattended installation.

Note

Since Wazuh 3.5 it is necessary to have internet connection when following this process.

  1. The script will ask about what kind of installation you want. Type agent in order to install a Wazuh agent:

1- What kind of installation do you want (manager, agent, local, hybrid or help)? agent

Now that the agent is installed, the next step is to register and configure it to communicate with the manager. For more information about this process, please visit the document: user manual.

Uninstall

To uninstall Wazuh agent, set WAZUH_HOME with the current installation path:

# WAZUH_HOME="/WAZUH/INSTALLATION/PATH"

Stop the service:

# service wazuh-agent stop 2> /dev/null

Stop the daemon:

# $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null

Remove the installation folder and all its content:

# rm -rf $WAZUH_HOME

Delete the service:

# find /sbin/{init.d,rc*.d} -name "*wazuh*" | xargs rm -f

Remove users:

# userdel ossec 2> /dev/null
# userdel ossecm 2> /dev/null
# userdel ossecr 2> /dev/null
# groupdel ossec 2> /dev/null