Wazuh server

The Wazuh server analyzes the data received from the Wazuh agents, triggering alerts when threats or anomalies are detected. It is also used to remotely manage the configurations of Wazuh agents and monitor their status. If you want to learn more about the Wazuh components, check the Getting started section.

You can install the Wazuh server on a single host or distribute it across multiple nodes in a cluster configuration. Multi-node configurations provide high availability and improved performance. When combined with a network load balancer, you can achieve efficient use of its capacity.

Check the requirements below and choose an installation method to start installing the Wazuh server.

1
2
3

Install the Wazuh indexer

../../_images/Indexer-Circle.png

Install the Wazuh server

../../_images/Server-Circle.png

Install the Wazuh dashboard

../../_images/Dashboard-noBG.png

Requirements

Check the supported operating systems and the recommended hardware requirements for the Wazuh server installation. Make sure that your system environment meets all requirements and that you have root user privileges.

Hardware requirements

You can install the Wazuh server as a single-node or multi-node cluster.

  • Hardware recommendations

    Minimum

    Recommended

    Component

    RAM (GB)

    CPU (cores)

    RAM (GB)

    CPU (cores)

    Wazuh server

    2

    2

    4

    8

  • Disk space requirements

    The disk space the Wazuh server needs covers the vulnerability detection database and alert storage. The space for alerts depends on the generated alerts per second (APS). This table details the estimated disk space needed per agent to store 90 days of alerts on a Wazuh server, depending on the type of monitored endpoints.

    Monitored endpoints

    APS
    Storage in Wazuh Server
    (GB/90 days)

    Servers

    0.25

    0.1

    Workstations

    0.1

    0.04

    Network devices

    0.5

    0.2

    For example, for an environment with 80 workstations, 10 servers, and 10 network devices, the storage needed on the Wazuh server for 90 days of alerts is 6 GB. Adding 11 GB for the vulnerability detection database brings the total to 17 GB.

    Note

    The Wazuh manager ships the vulnerability detection database compressed and unpacks it on its first start. During this process, the compressed file, a temporary archive in /var/ossec/tmp, and the extracted database in /var/ossec/queue/vd exist at the same time. Make sure the volume that holds /var/ossec has at least 20 GB of free space before you start the Wazuh manager for the first time. Once unpacking finishes, the temporary files are removed and the database takes about 11 GB.

Scaling

To determine if a Wazuh server requires more resources, monitor these files:

  • /var/ossec/var/run/wazuh-analysisd.state: the variable events_dropped indicates whether events are being dropped due to lack of resources.

  • /var/ossec/var/run/wazuh-remoted.state: the variable discarded_count indicates if messages from the agents were discarded.

These two variables should be zero if the environment is working properly. If it is not the case, you can add additional nodes to the cluster.