How to Install the Wazuh Agent on Linux

To install the Wazuh agent on Linux (Debian/Ubuntu), add the official repository, install the wazuh-agent package, set the server IP in ossec.conf and start the service with systemctl start wazuh-agent. The whole process takes less than 10 minutes.

How do you install the Wazuh agent on Linux step by step?

In this guide I'll show you how to install the Wazuh agent on Linux (Debian/Ubuntu) and configure the most important parts of the ossec.conf file. The agent is the component that collects logs, monitors file integrity and sends all the information to the Wazuh server.

Why does the agent need connectivity with the server first?

You can verify connectivity in several ways:

1. Ping the server

ping IP_SERVIDOR

2. Check access to the Dashboard (port 443)

# Using curl
curl -k https://IP_SERVIDOR

# Or open it in the browser
https://IP_SERVIDOR

If the Dashboard loads correctly, there is connectivity. If it doesn't work, check:

• Server firewall (ports 443 and 1514 open)
• Client firewall
• Network/VPN configuration if they are on different networks

What is the command to install the Wazuh agent?

Run these commands as root or with sudo. This guide uses Wazuh 4.9.2, the version pinned in the package URL below; if you run a different server version, match the agent package to it. You must replace the following values with the ones from your environment:

• WAZUH_MANAGER: IP or hostname of your Wazuh server
• WAZUH_AGENT_NAME: Identifying name for this agent (e.g.: web-server, db-production, etc.)

Debian/Ubuntu

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.2-1_amd64.deb && sudo WAZUH_MANAGER='TU_IP_SERVIDOR' WAZUH_AGENT_NAME='NOMBRE_AGENTE' dpkg -i ./wazuh-agent_4.9.2-1_amd64.deb

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.2-1_amd64.deb && sudo WAZUH_MANAGER='192.168.1.100' WAZUH_AGENT_NAME='servidor-web' dpkg -i ./wazuh-agent_4.9.2-1_amd64.deb

Enable and start the service

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Where is the ossec.conf configuration file?

The agent configuration file is located at:

/var/ossec/etc/ossec.conf

This XML file contains the entire agent configuration. The two most important sections are localfile and syscheck.

What does the localfile section do for log monitoring?

The <localfile> section defines which system logs you want to send to Wazuh. By default the agent monitors system logs, but you can add logs from specific applications.

Example: adding Apache2 logs

To monitor Apache2 error logs, edit the ossec.conf file:

sudo nano /var/ossec/etc/ossec.conf

Add the following configuration inside the <ossec_config> block:

<localfile>
  <log_format>apache</log_format>
  <location>/var/log/apache2/error.log</location>
</localfile>

<localfile>
  <log_format>apache</log_format>
  <location>/var/log/apache2/access.log</location>
</localfile>

What is the syscheck section for File Integrity Monitoring?

The <syscheck> section configures File Integrity Monitoring. This feature detects changes in critical system files and folders. In the example below the <frequency> value is 300 seconds (every 5 minutes), which is the default scan interval; lower it for higher-sensitivity directories or raise it to reduce CPU usage on busy servers.

Example configuration:

<syscheck>
  <frequency>300</frequency>
  <directories check_all="yes">/etc</directories>
  <directories check_all="yes">/usr/bin</directories>
  <directories check_all="yes">/var/www</directories>
</syscheck>

How do you restart the agent service after changes?

After modifying the ossec.conf file, you must restart the service to apply the changes:

# Restart the agent
sudo systemctl restart wazuh-agent

# Check status
sudo systemctl status wazuh-agent

# Enable automatic startup
sudo systemctl enable wazuh-agent

Which commands are useful to manage the agent?

Some additional commands to manage the agent:

# View the agent logs
sudo tail -f /var/ossec/logs/ossec.log

# Verify the connection with the server
sudo /var/ossec/bin/agent-auth -m IP_SERVIDOR

# View agent information
sudo /var/ossec/bin/agent_control -i

Frequently Asked Questions

How long does it take to install the Wazuh agent on Linux?

The full process takes less than 10 minutes: downloading the .deb package, installing it with the WAZUH_MANAGER and WAZUH_AGENT_NAME variables, and starting the service with systemctl. The agent registers automatically with the server if connectivity exists.

Which ports does the Wazuh agent need open?

The agent communicates with the server over TCP port 1514 to send events, and uses port 1515 only during the initial enrollment. Port 443 is used to access the dashboard. Make sure both the server and client firewalls allow these ports.

Where is the Wazuh agent configuration file located?

The configuration file is at /var/ossec/etc/ossec.conf. It is an XML file where the two most important sections are localfile (which logs to collect) and syscheck (File Integrity Monitoring).

Do I need to restart the agent after editing ossec.conf?

Yes. After modifying ossec.conf you must run sudo systemctl restart wazuh-agent for the changes to take effect, then check the result with systemctl status wazuh-agent.

How do I verify the agent is connected to the Wazuh server?

Run sudo tail -f /var/ossec/logs/ossec.log and look for a "Connected to the server" message. You can also list the agent status from the server with /var/ossec/bin/agent_control -i, or confirm the agent appears as Active in the dashboard.

Additional resources

• Official documentation: Linux agent
• Log Data Collection in Wazuh
• Installing Wazuh Server on Linux
• Installing the Wazuh Agent on Windows

Related articles:

• How to Install Wazuh on Linux (Ubuntu 24.04)
• How to Install Wazuh with Docker Compose
• How to Install the Wazuh Agent on Windows
• What is Wazuh and what is it for?