Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support ARM architecture for Wazuh central components #155

Closed
4 tasks done
c-bordon opened this issue Dec 4, 2024 · 7 comments · Fixed by #225
Closed
4 tasks done

Support ARM architecture for Wazuh central components #155

c-bordon opened this issue Dec 4, 2024 · 7 comments · Fixed by #225
Assignees
@fcaffieri
Labels
level/task Task issue type/enhancement Enhancement issue

Comments

@c-bordon
Copy link
Member

c-bordon commented Dec 4, 2024 •
edited by fcaffieri
Loading

Description

In the Wazuh 4.10.2 version, Wazuh central components support ARM64 architecture, so it is necessary to verify that the operating systems supported by Wazuh installation assistant for AMD64 architecture also support ARM64.

Tasks

  • Analyze what changes would be necessary to make in the scripts to support the ARM architecture
  • Perform tests for the ARM architecture (single node, multi node, and offline)
  • Revise the installation documentation to include instructions and notes specific to ARM architecture setups.
  • Verify that the deployment works for both AMD64 and ARM64 architectures

Related

Modify installation scripts for ARM architecture.
@c-bordon c-bordon added level/task Task issue type/enhancement Enhancement issue labels Dec 4, 2024
@c-bordon c-bordon self-assigned this Dec 5, 2024
@wazuhci wazuhci moved this to On hold in XDR+SIEM/Release 4.12.0 Dec 20, 2024
@wazuhci wazuhci moved this from On hold to Blocked in XDR+SIEM/Release 4.12.0 Jan 20, 2025
@teddytpc1
Copy link
Member

teddytpc1 commented Jan 20, 2025 •
edited
Loading

Packages were created: info.

@teddytpc1 teddytpc1 assigned fcaffieri and unassigned c-bordon Jan 20, 2025
@wazuhci wazuhci moved this from Blocked to On hold in XDR+SIEM/Release 4.12.0 Jan 20, 2025
@wazuhci wazuhci moved this from On hold to In progress in XDR+SIEM/Release 4.12.0 Jan 21, 2025
@fcaffieri
Copy link
Member

Update report

An attempt was made to run the Wazuh installation wizard on a CentOS8 arm and at first it was necessary to modify the script due to several validations for the architecture.
After this, it was necessary to configure the variables to obtain the packages from the repository where they were uploaded.
After this, we continue to analyze what modifications are necessary, since when running the wizard it cannot find the packages and therefore cannot perform the installation.
Due to other priorities, we could not advance as expected at the moment.

@fcaffieri
Copy link
Member

Update report

The necessary modifications were made to the installation wizard and tests are being carried out on ARM to see that everything installs correctly.
So far, the following has been achieved:

  • Generate certificates
  • Install wazuh-indexer
  • Install wazuh-manager
  • Install felebeat
  • Problems were detected in the filebeat configuration (analyzing)
root@ip-172-31-38-17:/home/ubuntu# bash ./wazuh-install.sh -a -i
01/23/2025 21:51:44 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
01/23/2025 21:51:44 INFO: Verbose logging redirected to /var/log/wazuh-install.log
01/23/2025 21:51:51 WARNING: Hardware checks ignored.
01/23/2025 21:51:51 INFO: Wazuh web interface port will be 443.
01/23/2025 21:52:01 INFO: Wazuh repository added.
01/23/2025 21:52:01 INFO: --- Configuration files ---
01/23/2025 21:52:01 INFO: Generating configuration files.
01/23/2025 21:52:01 INFO: Generating the root certificate.
01/23/2025 21:52:02 INFO: Generating Admin certificates.
01/23/2025 21:52:03 INFO: Generating Wazuh indexer certificates.
01/23/2025 21:52:03 INFO: Generating Filebeat certificates.
01/23/2025 21:52:04 INFO: Generating Wazuh dashboard certificates.
01/23/2025 21:52:05 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
01/23/2025 21:52:05 INFO: --- Wazuh indexer ---
01/23/2025 21:52:05 INFO: Starting Wazuh indexer installation.
01/23/2025 21:52:25 INFO: Wazuh indexer installation finished.
01/23/2025 21:52:25 INFO: Wazuh indexer post-install configuration finished.
01/23/2025 21:52:25 INFO: Starting service wazuh-indexer.
01/23/2025 21:52:40 INFO: wazuh-indexer service started.
01/23/2025 21:52:40 INFO: Initializing Wazuh indexer cluster security settings.
01/23/2025 21:52:44 INFO: Wazuh indexer cluster security configuration initialized.
01/23/2025 21:52:44 INFO: Wazuh indexer cluster initialized.
01/23/2025 21:52:44 INFO: --- Wazuh server ---
01/23/2025 21:52:44 INFO: Starting the Wazuh manager installation.
01/23/2025 21:53:55 INFO: Wazuh manager installation finished.
01/23/2025 21:53:56 INFO: Wazuh manager vulnerability detection configuration finished.
01/23/2025 21:53:56 INFO: Starting service wazuh-manager.
01/23/2025 21:54:14 INFO: wazuh-manager service started.
01/23/2025 21:54:14 INFO: Starting Filebeat installation.
01/23/2025 21:54:31 INFO: Filebeat installation finished.
curl: (22) The requested URL returned error: 404
01/23/2025 21:54:31 ERROR: Error downloading wazuh-template.json file.
01/23/2025 21:54:31 INFO: --- Removing existing Wazuh installation ---
01/23/2025 21:54:31 INFO: Removing Wazuh manager.
01/23/2025 21:54:48 INFO: Wazuh manager removed.
01/23/2025 21:54:48 INFO: Removing Wazuh indexer.
01/23/2025 21:54:55 INFO: Wazuh indexer removed.
01/23/2025 21:54:55 INFO: Removing Filebeat.
01/23/2025 21:55:02 INFO: Filebeat removed.
01/23/2025 21:55:02 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.

@fcaffieri
Copy link
Member

Update report

root@ip-172-31-38-17:/home/ubuntu# bash ./wazuh-install.sh -a -i
24/01/2025 18:22:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
24/01/2025 18:22:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log
24/01/2025 18:22:32 WARNING: Hardware checks ignored.
24/01/2025 18:22:32 INFO: Wazuh web interface port will be 443.
24/01/2025 18:22:42 INFO: Wazuh repository added.
24/01/2025 18:22:42 INFO: --- Configuration files ---
24/01/2025 18:22:42 INFO: Generating configuration files.
24/01/2025 18:22:43 INFO: Generating the root certificate.
24/01/2025 18:22:43 INFO: Generating Admin certificates.
24/01/2025 18:22:44 INFO: Generating Wazuh indexer certificates.
24/01/2025 18:22:45 INFO: Generating Filebeat certificates.
24/01/2025 18:22:45 INFO: Generating Wazuh dashboard certificates.
24/01/2025 18:22:46 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
24/01/2025 18:22:46 INFO: --- Wazuh indexer ---
24/01/2025 18:22:46 INFO: Starting Wazuh indexer installation.
24/01/2025 18:23:06 INFO: Wazuh indexer installation finished.
24/01/2025 18:23:06 INFO: Wazuh indexer post-install configuration finished.
24/01/2025 18:23:06 INFO: Starting service wazuh-indexer.
24/01/2025 18:23:21 INFO: wazuh-indexer service started.
24/01/2025 18:23:21 INFO: Initializing Wazuh indexer cluster security settings.
24/01/2025 18:23:25 INFO: Wazuh indexer cluster security configuration initialized.
24/01/2025 18:23:25 INFO: Wazuh indexer cluster initialized.
24/01/2025 18:23:25 INFO: --- Wazuh server ---
24/01/2025 18:23:25 INFO: Starting the Wazuh manager installation.
24/01/2025 18:24:37 INFO: Wazuh manager installation finished.
24/01/2025 18:24:37 INFO: Wazuh manager vulnerability detection configuration finished.
24/01/2025 18:24:37 INFO: Starting service wazuh-manager.
24/01/2025 18:24:56 INFO: wazuh-manager service started.
24/01/2025 18:24:56 INFO: Starting Filebeat installation.
24/01/2025 18:25:14 INFO: Filebeat installation finished.
24/01/2025 18:25:15 INFO: Filebeat post-install configuration finished.
24/01/2025 18:25:15 INFO: Starting service filebeat.
24/01/2025 18:25:16 INFO: filebeat service started.
24/01/2025 18:25:16 INFO: --- Wazuh dashboard ---
24/01/2025 18:25:16 INFO: Starting Wazuh dashboard installation.
24/01/2025 18:27:48 INFO: Wazuh dashboard installation finished.
24/01/2025 18:27:48 INFO: Wazuh dashboard post-install configuration finished.
24/01/2025 18:27:48 INFO: Starting service wazuh-dashboard.
24/01/2025 18:27:49 INFO: wazuh-dashboard service started.
24/01/2025 18:27:51 INFO: Updating the internal users.
24/01/2025 18:27:59 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
24/01/2025 18:28:11 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
24/01/2025 18:28:44 INFO: Initializing Wazuh dashboard web application.
24/01/2025 18:28:45 INFO: Wazuh dashboard web application initialized.
24/01/2025 18:28:45 INFO: --- Summary ---
24/01/2025 18:28:45 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: adyVh2tLzeqv2ns.Uzo3SK9B?0Tk0FtR
24/01/2025 18:28:45 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2025-01-24 18:28:32 UTC; 35min ago
      Tasks: 173 (limit: 9308)
     Memory: 2.4G
        CPU: 23min 31.258s
     CGroup: /system.slice/wazuh-manager.service
             ├─273966 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─273967 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─273970 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─273973 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─274014 /var/ossec/bin/wazuh-authd
             ├─274031 /var/ossec/bin/wazuh-db
             ├─274056 /var/ossec/bin/wazuh-execd
             ├─274070 /var/ossec/bin/wazuh-analysisd
             ├─274131 /var/ossec/bin/wazuh-syscheckd
             ├─274152 /var/ossec/bin/wazuh-remoted
             ├─274193 /var/ossec/bin/wazuh-logcollector
             ├─274249 /var/ossec/bin/wazuh-monitord
             └─274311 /var/ossec/bin/wazuh-modulesd

Jan 24 18:28:26 ip-172-31-38-17 env[273902]: Started wazuh-syscheckd...
Jan 24 18:28:27 ip-172-31-38-17 env[273902]: Started wazuh-remoted...
Jan 24 18:28:28 ip-172-31-38-17 env[273902]: Started wazuh-logcollector...
Jan 24 18:28:29 ip-172-31-38-17 env[273902]: Started wazuh-monitord...
Jan 24 18:28:29 ip-172-31-38-17 env[273902]: wazuh-modulesd: Process 273936 not used by Wazuh, removing...
Jan 24 18:28:29 ip-172-31-38-17 env[274308]: 2025/01/24 18:28:29 wazuh-modulesd:router: INFO: Loaded router module.
Jan 24 18:28:29 ip-172-31-38-17 env[274308]: 2025/01/24 18:28:29 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 24 18:28:30 ip-172-31-38-17 env[273902]: Started wazuh-modulesd...
Jan 24 18:28:32 ip-172-31-38-17 env[273902]: Completed.
Jan 24 18:28:32 ip-172-31-38-17 systemd[1]: Started Wazuh manager.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2025-01-24 18:23:21 UTC; 40min ago
       Docs: https://documentation.wazuh.com
   Main PID: 221566 (java)
      Tasks: 81 (limit: 9308)
     Memory: 1.3G
        CPU: 1min 2.794s
     CGroup: /system.slice/wazuh-indexer.service
             └─221566 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+Always>

Jan 24 18:23:09 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-i>
Jan 24 18:23:09 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 24 18:23:09 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: System::setSecurityManager will be removed in a future release
Jan 24 18:23:09 ip-172-31-38-17 systemd-entrypoint[221566]: Jan 24, 2025 6:23:09 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Jan 24 18:23:09 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: COMPAT locale provider will be removed in a future release
Jan 24 18:23:10 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 24 18:23:10 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-ind>
Jan 24 18:23:10 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 24 18:23:10 ip-172-31-38-17 systemd-entrypoint[221566]: WARNING: System::setSecurityManager will be removed in a future release
Jan 24 18:23:21 ip-172-31-38-17 systemd[1]: Started wazuh-indexer.
lines 1-21/21 (END)
systemctl status wazuh-indexer^C
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-dhasboard
Unit wazuh-dhasboard.service could not be found.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2025-01-24 18:28:34 UTC; 35min ago
   Main PID: 275296 (node)
      Tasks: 11 (limit: 9308)
     Memory: 183.1M
        CPU: 12.123s
     CGroup: /system.slice/wazuh-dashboard.service
             └─275296 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 24 18:53:41 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"response","@timestamp":"2025-01-24T18:53:41Z","tags":[],"pid":275296,"method":"get","statusCode":200,"r>
Jan 24 18:53:42 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"response","@timestamp":"2025-01-24T18:53:42Z","tags":[],"pid":275296,"method":"get","statusCode":200,"r>
Jan 24 18:53:43 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"response","@timestamp":"2025-01-24T18:53:43Z","tags":[],"pid":275296,"method":"get","statusCode":200,"r>
Jan 24 18:53:44 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"response","@timestamp":"2025-01-24T18:53:44Z","tags":[],"pid":275296,"method":"get","statusCode":200,"r>
Jan 24 18:53:45 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"response","@timestamp":"2025-01-24T18:53:45Z","tags":[],"pid":275296,"method":"get","statusCode":200,"r>
Jan 24 18:53:46 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"response","@timestamp":"2025-01-24T18:53:46Z","tags":[],"pid":275296,"method":"get","statusCode":401,"r>
Jan 24 18:53:47 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"error","@timestamp":"2025-01-24T18:53:47Z","tags":["connection","client","error"],"pid":275296,"level":>
Jan 24 18:53:47 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"error","@timestamp":"2025-01-24T18:53:47Z","tags":["connection","client","error"],"pid":275296,"level":>
Jan 24 18:53:48 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"response","@timestamp":"2025-01-24T18:53:48Z","tags":[],"pid":275296,"method":"get","statusCode":302,"r>
Jan 24 19:00:00 ip-172-31-38-17 opensearch-dashboards[275296]: {"type":"log","@timestamp":"2025-01-24T19:00:00Z","tags":["info","plugins","wazuh","monitoring"],"pid":275296,"m>

root@ip-172-31-38-17:/home/ubuntu# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
root@ip-172-31-38-17:/home/ubuntu#

Image

@fcaffieri
Copy link
Member

On hold for this issue

@wazuhci wazuhci moved this from In progress to On hold in XDR+SIEM/Release 4.12.0 Jan 27, 2025
@wazuhci wazuhci moved this from On hold to In progress in XDR+SIEM/Release 4.12.0 Jan 28, 2025
@fcaffieri
Copy link
Member

Update report

Currently working on distributed and offline testing. The modifications have already been made and are working, some of the changes made in the branch were taken

@fcaffieri fcaffieri mentioned this issue Jan 30, 2025
Merged
@fcaffieri fcaffieri linked a pull request Jan 30, 2025 that will close this issue
Support ARM architecture for Wazuh central components #225
Merged
@fcaffieri
Copy link
Member

fcaffieri commented Jan 30, 2025 •
edited
Loading

Update report

Important

For test this variables where ser:

repogpg="https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH"
repobaseurl="https://packages-dev.wazuh.com/idr1887/pre-release"
reporelease="unstable"
filebeat_wazuh_module="${repobaseurl}/filebeat/wazuh-filebeat-0.4.tar.gz"
bucket="packages-dev.wazuh.com/idr1887"
repository="pre-release"

And need to hardcode this variable filebeat_wazuh_template with:

'https://raw.githubusercontent.com/wazuh/wazuh/4.12.0/extensions/elasticsearch/7.x/wazuh-template.json'

Important

Revision change for offline install:

  manager_revision="707"
  indexer_revision="707"
  dashboard_revision="707"

Important

Wazuh_gpg_key changed:
from: readonly wazuh_gpg_key="https://${bucket}/key/GPG-KEY-WAZUH"
to: readonly wazuh_gpg_key="https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH"

Important

Another change in offline validation:
form:

if [ "${sys_type}" == "apt-get" ]; then
        required_files+=("${offline_packages_path}/filebeat-oss-*.deb" "${offline_packages_path}/wazuh-dashboard_*.deb" "${offline_packages_path}/> wazuh-indexer_*.deb" "${offline_packages_path}/wazuh-manager_*.deb")
    elif [ "${sys_type}" == "rpm" ]; then
        required_files+=("${offline_packages_path}/filebeat-oss-*.rpm" "${offline_packages_path}/wazuh-dashboard_*.rpm" "${offline_packages_path}/> wazuh-indexer_*.rpm" "${offline_packages_path}/wazuh-manager_*.rpm")
    fi

to:

if [ "${sys_type}" == "apt-get" ]; then
    required_files+=("${offline_packages_path}/filebeat_*.deb" "${offline_packages_path}/wazuh-dashboard_*.deb" "${offline_packages_path}/wazuh-indexer_*.deb" "${offline_packages_path}/wazuh-manager_*.deb")
elif [ "${sys_type}" == "rpm" ]; then
    required_files+=("${offline_packages_path}/filebeat-*.rpm" "${offline_packages_path}/wazuh-dashboard_*.rpm" "${offline_packages_path}/wazuh-indexer_*.rpm" "${offline_packages_path}/wazuh-manager_*.rpm")
fi

These ios because the name of the filebeat change without -oss

Test cases for ARM64:

Sysmtem details: 
root@ip-172-31-38-17:/home/ubuntu# uname -a
Linux ip-172-31-38-17 6.2.0-1012-aws #12~22.04.1-Ubuntu SMP Thu Sep  7 16:00:15 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
root@ip-172-31-38-17:/home/ubuntu# uname -m
aarch64
root@ip-172-31-38-17:/home/ubuntu# cat /etc/os-release 
PRETTY_NAME="Ubuntu 22.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
root@ip-172-31-38-17:/home/ubuntu#
Test AIO Install 🟢 
root@ip-172-31-38-17:/home/ubuntu# bash ./wazuh-install.sh -a -i
30/01/2025 20:18:18 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 20:18:18 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 20:18:25 INFO: --- Removing existing Wazuh installation ---
30/01/2025 20:18:25 INFO: Wazuh GPG key not found in the system
30/01/2025 20:18:25 INFO: Installation cleaned.
30/01/2025 20:18:25 WARNING: Hardware checks ignored.
30/01/2025 20:18:25 INFO: Wazuh web interface port will be 443.
30/01/2025 20:18:35 INFO: Wazuh repository added.
30/01/2025 20:18:35 INFO: --- Configuration files ---
30/01/2025 20:18:35 INFO: Generating configuration files.
30/01/2025 20:18:35 INFO: Generating the root certificate.
30/01/2025 20:18:36 INFO: Generating Admin certificates.
30/01/2025 20:18:37 INFO: Generating Wazuh indexer certificates.
30/01/2025 20:18:37 INFO: Generating Filebeat certificates.
30/01/2025 20:18:39 INFO: Generating Wazuh dashboard certificates.
30/01/2025 20:18:40 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
30/01/2025 20:18:40 INFO: --- Wazuh indexer ---
30/01/2025 20:18:40 INFO: Starting Wazuh indexer installation.
30/01/2025 20:19:05 INFO: Wazuh indexer installation finished.
30/01/2025 20:19:05 INFO: Wazuh indexer post-install configuration finished.
30/01/2025 20:19:05 INFO: Starting service wazuh-indexer.
30/01/2025 20:19:20 INFO: wazuh-indexer service started.
30/01/2025 20:19:20 INFO: Initializing Wazuh indexer cluster security settings.
30/01/2025 20:19:24 INFO: Wazuh indexer cluster security configuration initialized.
30/01/2025 20:19:24 INFO: Wazuh indexer cluster initialized.
30/01/2025 20:19:24 INFO: --- Wazuh server ---
30/01/2025 20:19:24 INFO: Starting the Wazuh manager installation.
30/01/2025 20:20:37 INFO: Wazuh manager installation finished.
30/01/2025 20:20:37 INFO: Wazuh manager vulnerability detection configuration finished.
30/01/2025 20:20:37 INFO: Starting service wazuh-manager.
30/01/2025 20:20:56 INFO: wazuh-manager service started.
30/01/2025 20:20:56 INFO: Starting Filebeat installation.
30/01/2025 20:21:12 INFO: Filebeat installation finished.
30/01/2025 20:21:15 INFO: Filebeat post-install configuration finished.
30/01/2025 20:21:15 INFO: Starting service filebeat.
30/01/2025 20:21:16 INFO: filebeat service started.
30/01/2025 20:21:16 INFO: --- Wazuh dashboard ---
30/01/2025 20:21:16 INFO: Starting Wazuh dashboard installation.
30/01/2025 20:23:45 INFO: Wazuh dashboard installation finished.
30/01/2025 20:23:45 INFO: Wazuh dashboard post-install configuration finished.
30/01/2025 20:23:45 INFO: Starting service wazuh-dashboard.
30/01/2025 20:23:46 INFO: wazuh-dashboard service started.
30/01/2025 20:23:47 INFO: Updating the internal users.
30/01/2025 20:23:51 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
30/01/2025 20:24:03 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
30/01/2025 20:24:36 INFO: Initializing Wazuh dashboard web application.
30/01/2025 20:24:37 INFO: Wazuh dashboard web application initialized.
30/01/2025 20:24:37 INFO: --- Summary ---
30/01/2025 20:24:37 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: xxxxxxxxxxxxxxxxxxxxxxx
30/01/2025 20:24:37 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu# 
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 20:19:20 UTC; 5min ago
       Docs: https://documentation.wazuh.com
   Main PID: 373785 (java)
      Tasks: 81 (limit: 9308)
     Memory: 1.3G
        CPU: 51.421s
     CGroup: /system.slice/wazuh-indexer.service
             └─373785 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+Always>

Jan 30 20:19:08 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-i>
Jan 30 20:19:08 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 30 20:19:08 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 20:19:09 ip-172-31-38-17 systemd-entrypoint[373785]: Jan 30, 2025 8:19:09 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Jan 30 20:19:09 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: COMPAT locale provider will be removed in a future release
Jan 30 20:19:09 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 30 20:19:09 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-ind>
Jan 30 20:19:09 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 30 20:19:09 ip-172-31-38-17 systemd-entrypoint[373785]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 20:19:20 ip-172-31-38-17 systemd[1]: Started wazuh-indexer.
lines 1-21/21 (END)
^C
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 20:24:24 UTC; 47s ago
      Tasks: 174 (limit: 9308)
     Memory: 870.1M
        CPU: 25.159s
     CGroup: /system.slice/wazuh-manager.service
             ├─426150 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─426151 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─426154 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─426157 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─426198 /var/ossec/bin/wazuh-authd
             ├─426214 /var/ossec/bin/wazuh-db
             ├─426239 /var/ossec/bin/wazuh-execd
             ├─426253 /var/ossec/bin/wazuh-analysisd
             ├─426314 /var/ossec/bin/wazuh-syscheckd
             ├─426336 /var/ossec/bin/wazuh-remoted
             ├─426373 /var/ossec/bin/wazuh-logcollector
             ├─426424 /var/ossec/bin/wazuh-monitord
             └─426487 /var/ossec/bin/wazuh-modulesd

Jan 30 20:24:18 ip-172-31-38-17 env[426088]: Started wazuh-syscheckd...
Jan 30 20:24:19 ip-172-31-38-17 env[426088]: Started wazuh-remoted...
Jan 30 20:24:20 ip-172-31-38-17 env[426088]: Started wazuh-logcollector...
Jan 30 20:24:21 ip-172-31-38-17 env[426088]: Started wazuh-monitord...
Jan 30 20:24:21 ip-172-31-38-17 env[426088]: wazuh-modulesd: Process 426121 not used by Wazuh, removing...
Jan 30 20:24:21 ip-172-31-38-17 env[426482]: 2025/01/30 20:24:21 wazuh-modulesd:router: INFO: Loaded router module.
Jan 30 20:24:21 ip-172-31-38-17 env[426482]: 2025/01/30 20:24:21 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 30 20:24:22 ip-172-31-38-17 env[426088]: Started wazuh-modulesd...
Jan 30 20:24:24 ip-172-31-38-17 env[426088]: Completed.
Jan 30 20:24:24 ip-172-31-38-17 systemd[1]: Started Wazuh manager.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 20:24:26 UTC; 50s ago
   Main PID: 427475 (node)
      Tasks: 11 (limit: 9308)
     Memory: 164.9M
        CPU: 9.418s
     CGroup: /system.slice/wazuh-dashboard.service
             └─427475 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 30 20:24:34 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:24:34Z","tags":["info","plugins","wazuh","initialize"],"pid":427475,"m>
Jan 30 20:24:34 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:24:34Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":42747>
Jan 30 20:24:34 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:24:34Z","tags":["info","plugins","wazuh","monitoring"],"pid":427475,"m>
Jan 30 20:24:34 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:24:34Z","tags":["listening","info"],"pid":427475,"message":"Server run>
Jan 30 20:24:34 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:24:34Z","tags":["info","http","server","OpenSearchDashboards"],"pid":4>
Jan 30 20:24:34 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:24:34Z","tags":["info","plugins","wazuh","monitoring"],"pid":427475,"m>
Jan 30 20:24:36 ip-172-31-38-17 opensearch-dashboards[427475]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeo>
Jan 30 20:24:37 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"response","@timestamp":"2025-01-30T20:24:36Z","tags":[],"pid":427475,"method":"get","statusCode":200,"r>
Jan 30 20:25:00 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:25:00Z","tags":["error","opensearch","data"],"pid":427475,"message":"[>
Jan 30 20:25:00 ip-172-31-38-17 opensearch-dashboards[427475]: {"type":"log","@timestamp":"2025-01-30T20:25:00Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":42747>

root@ip-172-31-38-17:/home/ubuntu# 

root@ip-172-31-38-17:/home/ubuntu# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
root@ip-172-31-38-17:/home/ubuntu# 
root@ip-172-31-38-17:/home/ubuntu# grep -i -E "(error|warning)" /var/ossec/logs/ossec.log 
root@ip-172-31-38-17:/home/ubuntu#

Image

Test Uninstall 🟢 
root@ip-172-31-38-17:/home/ubuntu# bash ./wazuh-install.sh -u
30/01/2025 20:27:45 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 20:27:45 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 20:27:47 INFO: Removing Wazuh manager.
30/01/2025 20:28:01 INFO: Wazuh manager removed.
30/01/2025 20:28:01 INFO: Removing Wazuh indexer.
30/01/2025 20:28:08 INFO: Wazuh indexer removed.
30/01/2025 20:28:08 INFO: Removing Filebeat.
30/01/2025 20:28:14 INFO: Filebeat removed.
30/01/2025 20:28:14 INFO: Removing Wazuh dashboard.
30/01/2025 20:28:24 INFO: Wazuh dashboard removed.
root@ip-172-31-38-17:/home/ubuntu# ls -ltr /var/ossec
ls: cannot access '/var/ossec': No such file or directory
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-indexer
Unit wazuh-indexer.service could not be found.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-manager
Unit wazuh-manager.service could not be found.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-dashboard
Unit wazuh-dashboard.service could not be found.
root@ip-172-31-38-17:/home/ubuntu#
Test Distributed 🟢
Test install Indexer 🟢 
root@ip-172-31-38-17:/home/ubuntu# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: 127.0.0.1
    #- name: node-2
    #  ip: "<indexer-node-ip>"
    #- name: node-3
    #  ip: "<indexer-node-ip>"

  # Wazuh server nodes
  # If there is more than one Wazuh server
  # node, each one must have a node_type
  server:
    - name: wazuh-1
      ip: 127.0.0.1
    #  node_type: master
    #- name: wazuh-2
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker
    #- name: wazuh-3
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker

  # Wazuh dashboard nodes
  dashboard:
    - name: dashboard
      ip: 127.0.0.1
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --generate-config-files
30/01/2025 20:52:39 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 20:52:39 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 20:52:46 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 20:52:46 INFO: --- Configuration files ---
30/01/2025 20:52:46 INFO: Generating configuration files.
30/01/2025 20:52:46 INFO: Generating the root certificate.
30/01/2025 20:52:48 INFO: Generating Admin certificates.
30/01/2025 20:52:48 INFO: Generating Wazuh indexer certificates.
30/01/2025 20:52:49 INFO: Generating Filebeat certificates.
30/01/2025 20:52:50 INFO: Generating Wazuh dashboard certificates.
30/01/2025 20:52:50 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
root@ip-172-31-38-17:/home/ubuntu# ls -ltr
total 204
-rw-r--r-- 1 root root 193237 Jan 30 20:39 wazuh-install.sh
-rw------- 1 root root  11174 Jan 30 20:52 wazuh-install-files.tar
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --wazuh-indexer node-1
30/01/2025 20:53:05 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 20:53:05 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 20:53:11 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 20:53:19 INFO: Wazuh repository added.
30/01/2025 20:53:20 INFO: --- Wazuh indexer ---
30/01/2025 20:53:20 INFO: Starting Wazuh indexer installation.
30/01/2025 20:53:44 INFO: Wazuh indexer installation finished.
30/01/2025 20:53:44 INFO: Wazuh indexer post-install configuration finished.
30/01/2025 20:53:44 INFO: Starting service wazuh-indexer.
30/01/2025 20:53:59 INFO: wazuh-indexer service started.
30/01/2025 20:53:59 INFO: Initializing Wazuh indexer cluster security settings.
30/01/2025 20:54:01 INFO: Wazuh indexer cluster initialized.
30/01/2025 20:54:01 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu#
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --start-cluster
30/01/2025 21:08:22 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:08:22 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:08:29 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:08:31 INFO: Wazuh indexer cluster security configuration initialized.
30/01/2025 21:08:34 INFO: Updating the internal users.
30/01/2025 21:08:36 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
30/01/2025 21:08:49 INFO: Wazuh indexer cluster started.
root@ip-172-31-38-17:/home/ubuntu# 
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 20:53:59 UTC; 16min ago
       Docs: https://documentation.wazuh.com
   Main PID: 493368 (java)
      Tasks: 75 (limit: 9308)
     Memory: 1.3G
        CPU: 56.215s
     CGroup: /system.slice/wazuh-indexer.service
             └─493368 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+Always>

Jan 30 20:53:47 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-i>
Jan 30 20:53:47 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 30 20:53:47 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 20:53:48 ip-172-31-38-17 systemd-entrypoint[493368]: Jan 30, 2025 8:53:48 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Jan 30 20:53:48 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: COMPAT locale provider will be removed in a future release
Jan 30 20:53:48 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 30 20:53:48 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-ind>
Jan 30 20:53:48 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 30 20:53:48 ip-172-31-38-17 systemd-entrypoint[493368]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 20:53:59 ip-172-31-38-17 systemd[1]: Started wazuh-indexer.

root@ip-172-31-38-17:/home/ubuntu# tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'admin\'" -A 1
  indexer_username: 'admin'
  indexer_password: 'xxxxxxxx'
root@ip-172-31-38-17:/home/ubuntu# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-indexer-cluster",
  "cluster_uuid" : "c3DJkTRnQZuqJlSBPe00PQ",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "deb",
    "build_hash" : "20f04b54e84e90747c861bde395497f059929cea",
    "build_date" : "2025-01-17T12:58:50.149839Z",
    "build_snapshot" : false,
    "lucene_version" : "9.11.1",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}
root@ip-172-31-38-17:/home/ubuntu# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                               cluster_manager name
127.0.0.1           45          65   3    0.05    0.11     0.25 dimr      data,ingest,master,remote_cluster_client *               node-1
root@ip-172-31-38-17:/home/ubuntu#
Test install Server 🟢 
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --wazuh-server wazuh-1
30/01/2025 21:13:10 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:13:10 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:13:17 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:13:22 INFO: Wazuh repository added.
30/01/2025 21:13:22 INFO: --- Wazuh server ---
30/01/2025 21:13:22 INFO: Starting the Wazuh manager installation.
30/01/2025 21:14:35 INFO: Wazuh manager installation finished.
30/01/2025 21:14:35 INFO: Wazuh manager vulnerability detection configuration finished.
30/01/2025 21:14:35 INFO: Starting service wazuh-manager.
30/01/2025 21:14:54 INFO: wazuh-manager service started.
30/01/2025 21:14:54 INFO: Starting Filebeat installation.
30/01/2025 21:15:11 INFO: Filebeat installation finished.
30/01/2025 21:15:14 INFO: Filebeat post-install configuration finished.
30/01/2025 21:15:17 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
30/01/2025 21:15:41 INFO: Starting service filebeat.
30/01/2025 21:15:42 INFO: filebeat service started.
30/01/2025 21:15:42 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 21:15:38 UTC; 1min 4s ago
      Tasks: 168 (limit: 9308)
     Memory: 3.9G
        CPU: 54.873s
     CGroup: /system.slice/wazuh-manager.service
             ├─550174 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─550175 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─550178 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─550181 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─550222 /var/ossec/bin/wazuh-authd
             ├─550238 /var/ossec/bin/wazuh-db
             ├─550263 /var/ossec/bin/wazuh-execd
             ├─550277 /var/ossec/bin/wazuh-analysisd
             ├─550338 /var/ossec/bin/wazuh-syscheckd
             ├─550359 /var/ossec/bin/wazuh-remoted
             ├─550404 /var/ossec/bin/wazuh-logcollector
             ├─550459 /var/ossec/bin/wazuh-monitord
             └─550520 /var/ossec/bin/wazuh-modulesd

Jan 30 21:15:32 ip-172-31-38-17 env[550112]: Started wazuh-syscheckd...
Jan 30 21:15:33 ip-172-31-38-17 env[550112]: Started wazuh-remoted...
Jan 30 21:15:34 ip-172-31-38-17 env[550112]: Started wazuh-logcollector...
Jan 30 21:15:35 ip-172-31-38-17 env[550112]: Started wazuh-monitord...
Jan 30 21:15:35 ip-172-31-38-17 env[550112]: wazuh-modulesd: Process 550145 not used by Wazuh, removing...
Jan 30 21:15:35 ip-172-31-38-17 env[550518]: 2025/01/30 21:15:35 wazuh-modulesd:router: INFO: Loaded router module.
Jan 30 21:15:35 ip-172-31-38-17 env[550518]: 2025/01/30 21:15:35 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 30 21:15:36 ip-172-31-38-17 env[550112]: Started wazuh-modulesd...
Jan 30 21:15:38 ip-172-31-38-17 env[550112]: Completed.
Jan 30 21:15:38 ip-172-31-38-17 systemd[1]: Started Wazuh manager.
root@ip-172-31-38-17:/home/ubuntu# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
root@ip-172-31-38-17:/home/ubuntu#
Test install Dashboard 🟢 
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --wazuh-dashboard dashboard
30/01/2025 21:17:45 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:17:45 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:17:53 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:17:53 INFO: Wazuh web interface port will be 443.
30/01/2025 21:17:59 INFO: Wazuh repository added.
30/01/2025 21:17:59 INFO: --- Wazuh dashboard ----
30/01/2025 21:17:59 INFO: Starting Wazuh dashboard installation.
30/01/2025 21:18:57 INFO: Wazuh dashboard installation finished.
30/01/2025 21:18:57 INFO: Wazuh dashboard post-install configuration finished.
30/01/2025 21:18:57 INFO: Starting service wazuh-dashboard.
30/01/2025 21:18:58 INFO: wazuh-dashboard service started.
30/01/2025 21:19:19 INFO: Initializing Wazuh dashboard web application.
30/01/2025 21:19:20 INFO: Wazuh dashboard web application initialized.
30/01/2025 21:19:20 INFO: --- Summary ---
30/01/2025 21:19:20 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: Lb.wvaGQk.0*W9LwYEdswV5CHNgWJkM7
30/01/2025 21:19:20 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 21:19:04 UTC; 27s ago
   Main PID: 553541 (node)
      Tasks: 11 (limit: 9308)
     Memory: 181.5M
        CPU: 9.080s
     CGroup: /system.slice/wazuh-dashboard.service
             └─553541 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 30 21:19:11 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:11Z","tags":["info","plugins","wazuh","initialize"],"pid":553541,"m>
Jan 30 21:19:12 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:12Z","tags":["error","opensearch","data"],"pid":553541,"message":"[>
Jan 30 21:19:12 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:12Z","tags":["error","opensearch","data"],"pid":553541,"message":"[>
Jan 30 21:19:12 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:12Z","tags":["listening","info"],"pid":553541,"message":"Server run>
Jan 30 21:19:12 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:12Z","tags":["info","http","server","OpenSearchDashboards"],"pid":5>
Jan 30 21:19:12 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:12Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":55354>
Jan 30 21:19:12 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:12Z","tags":["info","plugins","wazuh","monitoring"],"pid":553541,"m>
Jan 30 21:19:12 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"log","@timestamp":"2025-01-30T21:19:12Z","tags":["error","plugins","wazuh","monitoring"],"pid":553541,">
Jan 30 21:19:19 ip-172-31-38-17 opensearch-dashboards[553541]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeo>
Jan 30 21:19:20 ip-172-31-38-17 opensearch-dashboards[553541]: {"type":"response","@timestamp":"2025-01-30T21:19:19Z","tags":[],"pid":553541,"method":"get","statusCode":200,"r>
lines 1-20/20 (END)
^C
root@ip-172-31-38-17:/home/ubuntu#

Image

Test Offline 🟢
Download package 🟢
  • Validations of new param:
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh -dw rpm
30/01/2025 21:55:53 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:55:53 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:56:00 ERROR: To download the packages it is necessary to set the architecture in -da|--download-arch <amd64|x86_64|arm64|aarch64>
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh -dw rpm -da amd65
30/01/2025 21:56:37 ERROR: Error on arguments. Probably missing <amd64|x86_64|arm64|aarch64> after -da|--download-arch

NAME
        wazuh-install.sh - Install and configure Wazuh central components: Wazuh server, Wazuh indexer, and Wazuh dashboard.

SYNOPSIS
        wazuh-install.sh [OPTIONS] -a | -c | -s | -wi <indexer-node-name> | -wd <dashboard-node-name> | -ws <server-node-name>

DESCRIPTION
        -a,  --all-in-one
                Install and configure Wazuh server, Wazuh indexer, Wazuh dashboard.

        -c,  --config-file <path-to-config-yml>
                Path to the configuration file used to generate wazuh-install-files.tar file containing the files that will be needed for installation. By default, the Wazuh installation assistant will search for a file named config.yml in the same path as the script.

        -d [pre-release|staging],  --development
                Use development repositories. By default it uses the pre-release package repository. If staging is specified, it will use that repository.

        -dw,  --download-wazuh <deb|rpm>
                Download all the packages necessary for offline installation. Type of packages to download for offline installation (rpm, deb)

        -da,  --download-arch <amd64|arm64|x86_64|aarch64>
                Define the architecture of the packages to download for offline installation.

        -fd,  --force-install-dashboard
                Force Wazuh dashboard installation to continue even when it is not capable of connecting to the Wazuh indexer.

        -g,  --generate-config-files
                Generate wazuh-install-files.tar file containing the files that will be needed for installation from config.yml. In distributed deployments you will need to copy this file to all hosts.

        -h,  --help
                Display this help and exit.

        -i,  --ignore-check
                Ignore the check for minimum hardware requirements.

        -o,  --overwrite
                Overwrites previously installed components. This will erase all the existing configuration and data.

        -of,  --offline-installation
                Perform an offline installation. This option must be used with -a, -ws, -s, -wi, or -wd.

        -p,  --port
                Specifies the Wazuh web user interface port. By default is the 443 TCP port. Recommended ports are: 8443, 8444, 8080, 8888, 9000.

        -s,  --start-cluster
                Initialize Wazuh indexer cluster security settings.

        -t,  --tar <path-to-certs-tar>
                Path to tar file containing certificate files. By default, the Wazuh installation assistant will search for a file named wazuh-install-files.tar in the same path as the script.

        -u,  --uninstall
                Uninstalls all Wazuh components. This will erase all the existing configuration and data.

        -v,  --verbose
                Shows the complete installation output.

        -V,  --version
                Shows the version of the script and Wazuh packages.

        -wd,  --wazuh-dashboard <dashboard-node-name>
                Install and configure Wazuh dashboard, used for distributed deployments.

        -wi,  --wazuh-indexer <indexer-node-name>
                Install and configure Wazuh indexer, used for distributed deployments.

        -ws,  --wazuh-server <server-node-name>
                Install and configure Wazuh manager and Filebeat, used for distributed deployments.
root@ip-172-31-38-17:/home/ubuntu# 
root@ip-172-31-38-17:/home/ubuntu# 
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh -dw rpm -da amd64
30/01/2025 21:56:43 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:56:43 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:56:50 ERROR: Architecture amd64 not valid for package type rpm
root@ip-172-31-38-17:/home/ubuntu#
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh -dw rpm -da arm64
30/01/2025 22:01:53 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 22:01:53 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 22:02:00 ERROR: Architecture arm64 not valid for package type rpm
root@ip-172-31-38-17:/home/ubuntu#
  • Download packages:
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh -dw deb -da arm64
30/01/2025 23:06:29 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:06:29 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:06:35 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:06:36 INFO: --- Download Packages ---
30/01/2025 23:06:36 INFO: Starting Wazuh packages download.
30/01/2025 23:06:36 INFO: Downloading Wazuh deb packages for arm64.
30/01/2025 23:06:39 INFO: The manager package was downloaded.
30/01/2025 23:06:40 INFO: The filebeat package was downloaded.
30/01/2025 23:07:02 INFO: The indexer package was downloaded.
30/01/2025 23:07:06 INFO: The dashboard package was downloaded.
30/01/2025 23:07:06 INFO: The packages are in wazuh-offline/wazuh-packages
30/01/2025 23:07:06 INFO: Downloading configuration files and assets.
30/01/2025 23:07:06 INFO: The resource https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH was downloaded.
30/01/2025 23:07:07 INFO: The resource https://packages-dev.wazuh.com/idr1887/4.12/tpl/wazuh/filebeat/filebeat.yml was downloaded.
30/01/2025 23:07:07 INFO: The resource https://raw.githubusercontent.com/wazuh/wazuh/4.12.0/extensions/elasticsearch/7.x/wazuh-template.json was downloaded.
30/01/2025 23:07:07 INFO: The resource https://packages-dev.wazuh.com/idr1887/pre-release/filebeat/wazuh-filebeat-0.4.tar.gz was downloaded.
30/01/2025 23:07:07 INFO: The configuration files and assets are in wazuh-offline.tar.gz
30/01/2025 23:07:59 INFO: You can follow the installation guide here https://documentation.wazuh.com/current/deployment-options/offline-installation.html
root@ip-172-31-38-17:/home/ubuntu# 
root@ip-172-31-38-17:/home/ubuntu# ls -tlr
total 1372472
-rw------- 1 root root      11178 Jan 30 21:47 wazuh-install-files.tar
-rw-r--r-- 1 root root     193517 Jan 30 23:06 wazuh-install.sh
-rw------- 1 root root 1405194882 Jan 30 23:07 wazuh-offline.tar.gz
root@ip-172-31-38-17:/home/ubuntu#
Install offline 🟢
  • Wazuh indexer
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --offline-installation --wazuh-indexer node-1
30/01/2025 23:13:54 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:13:54 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:13:54 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:13:58 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:13:59 INFO: Checking prerequisites for Offline installation.
30/01/2025 23:14:01 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:14:01 INFO: --- Wazuh indexer ---
30/01/2025 23:14:01 INFO: Starting Wazuh indexer installation.
30/01/2025 23:14:26 INFO: Wazuh indexer installation finished.
30/01/2025 23:14:26 INFO: Wazuh indexer post-install configuration finished.
30/01/2025 23:14:26 INFO: Starting service wazuh-indexer.
30/01/2025 23:14:41 INFO: wazuh-indexer service started.
30/01/2025 23:14:41 INFO: Initializing Wazuh indexer cluster security settings.
30/01/2025 23:14:43 INFO: Wazuh indexer cluster initialized.
30/01/2025 23:14:43 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --offline-installation --start-cluster
30/01/2025 23:16:38 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:16:38 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:16:38 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:16:42 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:16:42 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:16:45 INFO: Wazuh indexer cluster security configuration initialized.
30/01/2025 23:16:57 INFO: Updating the internal users.
30/01/2025 23:17:00 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
30/01/2025 23:17:12 INFO: Wazuh indexer cluster started.
root@ip-172-31-38-17:/home/ubuntu# tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'admin\'" -A 1
  indexer_username: 'admin'
  indexer_password: 'xxxxxxxxxxx'
root@ip-172-31-38-17:/home/ubuntu# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-indexer-cluster",
  "cluster_uuid" : "2Z3BdL3DQBKN70dFHUIfMQ",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "deb",
    "build_hash" : "20f04b54e84e90747c861bde395497f059929cea",
    "build_date" : "2025-01-17T12:58:50.149839Z",
    "build_snapshot" : false,
    "lucene_version" : "9.11.1",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}
root@ip-172-31-38-17:/home/ubuntu# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                               cluster_manager name
127.0.0.1           55          97   6    0.20    0.28     0.17 dimr      data,ingest,master,remote_cluster_client *               node-1
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 23:14:41 UTC; 4min 14s ago
       Docs: https://documentation.wazuh.com
   Main PID: 565808 (java)
      Tasks: 74 (limit: 9308)
     Memory: 1.3G
        CPU: 40.802s
     CGroup: /system.slice/wazuh-indexer.service
             └─565808 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+Always>

Jan 30 23:14:28 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-i>
Jan 30 23:14:28 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 30 23:14:28 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 23:14:29 ip-172-31-38-17 systemd-entrypoint[565808]: Jan 30, 2025 11:14:29 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Jan 30 23:14:29 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: COMPAT locale provider will be removed in a future release
Jan 30 23:14:30 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 30 23:14:30 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-ind>
Jan 30 23:14:30 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 30 23:14:30 ip-172-31-38-17 systemd-entrypoint[565808]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 23:14:41 ip-172-31-38-17 systemd[1]: Started wazuh-indexer.

root@ip-172-31-38-17:/home/ubuntu#
  • Wazuh manager
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --offline-installation --wazuh-server wazuh-1
30/01/2025 23:19:40 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:19:40 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:19:40 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:19:44 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:19:45 INFO: Checking prerequisites for Offline installation.
30/01/2025 23:19:47 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:19:47 INFO: --- Wazuh server ---
30/01/2025 23:19:47 INFO: Starting the Wazuh manager installation.
30/01/2025 23:21:00 INFO: Wazuh manager installation finished.
30/01/2025 23:21:00 INFO: Wazuh manager vulnerability detection configuration finished.
30/01/2025 23:21:00 INFO: Starting service wazuh-manager.
30/01/2025 23:21:19 INFO: wazuh-manager service started.
30/01/2025 23:21:19 INFO: Starting Filebeat installation.
30/01/2025 23:21:35 INFO: Filebeat installation finished.
30/01/2025 23:21:36 INFO: Filebeat post-install configuration finished.
30/01/2025 23:21:39 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
30/01/2025 23:22:04 INFO: Starting service filebeat.
30/01/2025 23:22:05 INFO: filebeat service started.
30/01/2025 23:22:05 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 23:22:01 UTC; 21s ago
      Tasks: 167 (limit: 9308)
     Memory: 3.2G
        CPU: 41.214s
     CGroup: /system.slice/wazuh-manager.service
             ├─618241 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─618242 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─618245 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─618248 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─618289 /var/ossec/bin/wazuh-authd
             ├─618305 /var/ossec/bin/wazuh-db
             ├─618318 /var/ossec/bin/wazuh-execd
             ├─618332 /var/ossec/bin/wazuh-analysisd
             ├─618405 /var/ossec/bin/wazuh-syscheckd
             ├─618427 /var/ossec/bin/wazuh-remoted
             ├─618460 /var/ossec/bin/wazuh-logcollector
             ├─618510 /var/ossec/bin/wazuh-monitord
             └─618572 /var/ossec/bin/wazuh-modulesd

Jan 30 23:21:55 ip-172-31-38-17 env[618176]: Started wazuh-syscheckd...
Jan 30 23:21:56 ip-172-31-38-17 env[618176]: Started wazuh-remoted...
Jan 30 23:21:57 ip-172-31-38-17 env[618176]: Started wazuh-logcollector...
Jan 30 23:21:58 ip-172-31-38-17 env[618176]: Started wazuh-monitord...
Jan 30 23:21:58 ip-172-31-38-17 env[618176]: wazuh-modulesd: Process 618212 not used by Wazuh, removing...
Jan 30 23:21:58 ip-172-31-38-17 env[618569]: 2025/01/30 23:21:58 wazuh-modulesd:router: INFO: Loaded router module.
Jan 30 23:21:58 ip-172-31-38-17 env[618569]: 2025/01/30 23:21:58 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 30 23:21:59 ip-172-31-38-17 env[618176]: Started wazuh-modulesd...
Jan 30 23:22:01 ip-172-31-38-17 env[618176]: Completed.
Jan 30 23:22:01 ip-172-31-38-17 systemd[1]: Started Wazuh manager.
root@ip-172-31-38-17:/home/ubuntu# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
root@ip-172-31-38-17:/home/ubuntu#
  • Wazuh dashboard
root@ip-172-31-38-17:/home/ubuntu# bash wazuh-install.sh --offline-installation --wazuh-dashboard dashboard
30/01/2025 23:23:33 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:23:33 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:23:33 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:23:37 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:23:37 INFO: Wazuh web interface port will be 443.
30/01/2025 23:23:38 INFO: Checking prerequisites for Offline installation.
30/01/2025 23:23:40 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:23:41 INFO: --- Wazuh dashboard ----
30/01/2025 23:23:41 INFO: Starting Wazuh dashboard installation.
30/01/2025 23:25:12 INFO: Wazuh dashboard installation finished.
30/01/2025 23:25:12 INFO: Wazuh dashboard post-install configuration finished.
30/01/2025 23:25:12 INFO: Starting service wazuh-dashboard.
30/01/2025 23:25:13 INFO: wazuh-dashboard service started.
30/01/2025 23:25:34 INFO: Initializing Wazuh dashboard web application.
30/01/2025 23:25:34 INFO: Wazuh dashboard web application initialized.
30/01/2025 23:25:34 INFO: --- Summary ---
30/01/2025 23:25:34 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: mvKtfaWO3XImnwinb*2hsFJQwAqto*X*
30/01/2025 23:25:34 INFO: Installation finished.
root@ip-172-31-38-17:/home/ubuntu# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-01-30 23:25:19 UTC; 1min 15s ago
   Main PID: 620798 (node)
      Tasks: 11 (limit: 9308)
     Memory: 189.5M
        CPU: 9.369s
     CGroup: /system.slice/wazuh-dashboard.service
             └─620798 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["info","plugins","wazuh","initialize"],"pid":620798,"m>
Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["error","opensearch","data"],"pid":620798,"message":"[>
Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["error","opensearch","data"],"pid":620798,"message":"[>
Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["listening","info"],"pid":620798,"message":"Server run>
Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["info","http","server","OpenSearchDashboards"],"pid":6>
Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["info","plugins","wazuh","monitoring"],"pid":620798,"m>
Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":62079>
Jan 30 23:25:26 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"log","@timestamp":"2025-01-30T23:25:26Z","tags":["error","plugins","wazuh","monitoring"],"pid":620798,">
Jan 30 23:25:34 ip-172-31-38-17 opensearch-dashboards[620798]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeo>
Jan 30 23:25:34 ip-172-31-38-17 opensearch-dashboards[620798]: {"type":"response","@timestamp":"2025-01-30T23:25:34Z","tags":[],"pid":620798,"method":"get","statusCode":200,"r>

root@ip-172-31-38-17:/home/ubuntu#

Image

Test cases for AMD64:

Important

Note:
For test this variables where ser:

repogpg="https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH"
repobaseurl="https://packages-dev.wazuh.com/idr1887/pre-release"
reporelease="unstable"
filebeat_wazuh_module="${repobaseurl}/filebeat/wazuh-filebeat-0.4.tar.gz"
bucket="packages-dev.wazuh.com/idr1887"
repository="pre-release"

And need to hardcode this variable filebeat_wazuh_template with:

'https://raw.githubusercontent.com/wazuh/wazuh/4.12.0/extensions/elasticsearch/7.x/wazuh-template.json'
Sysmtem details: 
[root@stack-centos8 vagrant]# uname -a
Linux stack-centos8 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 13:25:12 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
[root@stack-centos8 vagrant]# uname -m
x86_64
[root@stack-centos8 vagrant]# cat /etc/os-release 
NAME="CentOS Linux"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Linux 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"
CENTOS_MANTISBT_PROJECT="CentOS-8"
CENTOS_MANTISBT_PROJECT_VERSION="8"
[root@stack-centos8 vagrant]#
Test AIO Remove and Install 🟢 
[root@stack-centos8 vagrant]# bash ./wazuh-install.sh -a -i -o
30/01/2025 20:50:46 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 20:50:46 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 20:50:46 INFO: --- Removing existing Wazuh installation ---
30/01/2025 20:50:46 INFO: Removing Wazuh manager.
30/01/2025 20:51:24 INFO: Wazuh manager removed.
30/01/2025 20:51:24 INFO: Removing Wazuh indexer.
30/01/2025 20:51:26 WARNING: The Wazuh indexer package could not be removed.
30/01/2025 20:51:26 INFO: Removing Filebeat.
30/01/2025 20:51:27 WARNING: The Filebeat package could not be removed.
30/01/2025 20:51:27 INFO: Removing Wazuh dashboard.
30/01/2025 20:51:37 WARNING: The Wazuh dashboard package could not be removed.
30/01/2025 20:51:37 INFO: Installation cleaned.
30/01/2025 20:51:37 WARNING: Hardware checks ignored.
30/01/2025 20:51:37 INFO: Wazuh web interface port will be 443.
30/01/2025 20:51:38 WARNING: The system has Firewalld enabled. Please ensure that traffic is allowed on these ports: 1515, 1514, 443.
30/01/2025 20:51:39 INFO: Wazuh repository added.
30/01/2025 20:51:39 INFO: --- Configuration files ---
30/01/2025 20:51:39 INFO: Generating configuration files.
30/01/2025 20:51:39 INFO: Generating the root certificate.
30/01/2025 20:51:39 INFO: Generating Admin certificates.
30/01/2025 20:51:40 INFO: Generating Wazuh indexer certificates.
30/01/2025 20:51:40 INFO: Generating Filebeat certificates.
30/01/2025 20:51:40 INFO: Generating Wazuh dashboard certificates.
30/01/2025 20:51:40 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
30/01/2025 20:51:40 INFO: --- Wazuh indexer ---
30/01/2025 20:51:40 INFO: Starting Wazuh indexer installation.
30/01/2025 20:53:03 INFO: Wazuh indexer installation finished.
30/01/2025 20:53:03 INFO: Wazuh indexer post-install configuration finished.
30/01/2025 20:53:03 INFO: Starting service wazuh-indexer.
30/01/2025 20:53:18 INFO: wazuh-indexer service started.
30/01/2025 20:53:18 INFO: Initializing Wazuh indexer cluster security settings.
30/01/2025 20:53:22 INFO: Wazuh indexer cluster security configuration initialized.
30/01/2025 20:53:22 INFO: Wazuh indexer cluster initialized.
30/01/2025 20:53:22 INFO: --- Wazuh server ---
30/01/2025 20:53:22 INFO: Starting the Wazuh manager installation.
30/01/2025 20:55:14 INFO: Wazuh manager installation finished.
30/01/2025 20:55:14 INFO: Wazuh manager vulnerability detection configuration finished.
30/01/2025 20:55:14 INFO: Starting service wazuh-manager.
30/01/2025 20:55:28 INFO: wazuh-manager service started.
30/01/2025 20:55:28 INFO: Starting Filebeat installation.
30/01/2025 20:55:35 INFO: Filebeat installation finished.
30/01/2025 20:55:37 INFO: Filebeat post-install configuration finished.
30/01/2025 20:55:37 INFO: Starting service filebeat.
30/01/2025 20:55:37 INFO: filebeat service started.
30/01/2025 20:55:37 INFO: --- Wazuh dashboard ---
30/01/2025 20:55:37 INFO: Starting Wazuh dashboard installation.
30/01/2025 20:57:04 INFO: Wazuh dashboard installation finished.
30/01/2025 20:57:04 INFO: Wazuh dashboard post-install configuration finished.
30/01/2025 20:57:04 INFO: Starting service wazuh-dashboard.
30/01/2025 20:57:04 INFO: wazuh-dashboard service started.
30/01/2025 20:57:04 INFO: Updating the internal users.
30/01/2025 20:57:08 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
30/01/2025 20:57:20 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
30/01/2025 20:57:53 INFO: Initializing Wazuh dashboard web application.
30/01/2025 20:57:56 INFO: Wazuh dashboard web application initialized.
30/01/2025 20:57:56 INFO: --- Summary ---
30/01/2025 20:57:56 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: *9YibSI.5j2LjV+nEXHT1Vlv4nGROJTV
30/01/2025 20:57:56 INFO: Installation finished.
[root@stack-centos8 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 20:53:18 UTC; 5min ago
     Docs: https://documentation.wazuh.com
 Main PID: 14168 (java)
    Tasks: 82 (limit: 23684)
   Memory: 1.0G
   CGroup: /system.slice/wazuh-indexer.service
           └─14168 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPre>

Jan 30 20:53:05 stack-centos8 systemd-entrypoint[14168]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-inde>
Jan 30 20:53:05 stack-centos8 systemd-entrypoint[14168]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 30 20:53:05 stack-centos8 systemd-entrypoint[14168]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 20:53:05 stack-centos8 systemd-entrypoint[14168]: Jan 30, 2025 8:53:05 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Jan 30 20:53:05 stack-centos8 systemd-entrypoint[14168]: WARNING: COMPAT locale provider will be removed in a future release
Jan 30 20:53:06 stack-centos8 systemd-entrypoint[14168]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 30 20:53:06 stack-centos8 systemd-entrypoint[14168]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexe>
Jan 30 20:53:06 stack-centos8 systemd-entrypoint[14168]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 30 20:53:06 stack-centos8 systemd-entrypoint[14168]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 20:53:18 stack-centos8 systemd[1]: Started wazuh-indexer.

[root@stack-centos8 vagrant]# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 20:57:41 UTC; 42s ago
    Tasks: 174 (limit: 23684)
   Memory: 1.0G
   CGroup: /system.slice/wazuh-manager.service
           ├─18936 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─18937 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─18940 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─18943 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─18985 /var/ossec/bin/wazuh-authd
           ├─19002 /var/ossec/bin/wazuh-db
           ├─19028 /var/ossec/bin/wazuh-execd
           ├─19043 /var/ossec/bin/wazuh-analysisd
           ├─19109 /var/ossec/bin/wazuh-syscheckd
           ├─19124 /var/ossec/bin/wazuh-remoted
           ├─19160 /var/ossec/bin/wazuh-logcollector
           ├─19180 /var/ossec/bin/wazuh-monitord
           └─19222 /var/ossec/bin/wazuh-modulesd

Jan 30 20:57:35 stack-centos8 env[18871]: Started wazuh-syscheckd...
Jan 30 20:57:36 stack-centos8 env[18871]: Started wazuh-remoted...
Jan 30 20:57:37 stack-centos8 env[18871]: Started wazuh-logcollector...
Jan 30 20:57:38 stack-centos8 env[18871]: Started wazuh-monitord...
Jan 30 20:57:38 stack-centos8 env[18871]: wazuh-modulesd: Process 18905 not used by Wazuh, removing...
Jan 30 20:57:38 stack-centos8 env[18871]: 2025/01/30 20:57:38 wazuh-modulesd:router: INFO: Loaded router module.
Jan 30 20:57:38 stack-centos8 env[18871]: 2025/01/30 20:57:38 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 30 20:57:39 stack-centos8 env[18871]: Started wazuh-modulesd...
Jan 30 20:57:41 stack-centos8 env[18871]: Completed.
Jan 30 20:57:41 stack-centos8 systemd[1]: Started Wazuh manager.
[root@stack-centos8 vagrant]# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
   Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 20:57:43 UTC; 46s ago
 Main PID: 20101 (node)
    Tasks: 11 (limit: 23684)
   Memory: 191.7M
   CGroup: /system.slice/wazuh-dashboard.service
           └─20101 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 30 20:57:53 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:53Z","tags":["info","plugins","wazuh","initialize"],"pid":20101,"messa>
Jan 30 20:57:53 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:53Z","tags":["info","plugins","wazuh","initialize"],"pid":20101,"messa>
Jan 30 20:57:53 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:53Z","tags":["info","plugins","wazuh","initialize"],"pid":20101,"messa>
Jan 30 20:57:53 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:53Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":20101,"m>
Jan 30 20:57:53 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:53Z","tags":["info","plugins","wazuh","monitoring"],"pid":20101,"messa>
Jan 30 20:57:53 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:53Z","tags":["listening","info"],"pid":20101,"message":"Server running>
Jan 30 20:57:53 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:53Z","tags":["info","http","server","OpenSearchDashboards"],"pid":2010>
Jan 30 20:57:54 stack-centos8 opensearch-dashboards[20101]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout >
Jan 30 20:57:54 stack-centos8 opensearch-dashboards[20101]: {"type":"log","@timestamp":"2025-01-30T20:57:54Z","tags":["info","plugins","wazuh","monitoring"],"pid":20101,"messa>
Jan 30 20:57:55 stack-centos8 opensearch-dashboards[20101]: {"type":"response","@timestamp":"2025-01-30T20:57:54Z","tags":[],"pid":20101,"method":"get","statusCode":200,"req":>

[root@stack-centos8 vagrant]# 
[root@stack-centos8 vagrant]# 
[root@stack-centos8 vagrant]# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
[root@stack-centos8 vagrant]#
Test Uninstall 🟢 
[root@stack-centos8 vagrant]# bash ./wazuh-install.sh -u
30/01/2025 20:58:57 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 20:58:57 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 20:58:57 INFO: Removing Wazuh manager.
30/01/2025 20:59:38 INFO: Wazuh manager removed.
30/01/2025 20:59:38 INFO: Removing Wazuh indexer.
30/01/2025 20:59:39 INFO: Removing Filebeat.
30/01/2025 20:59:40 INFO: Removing Wazuh dashboard.
[root@stack-centos8 vagrant]# systemctl status wazuh-indexer
Unit wazuh-indexer.service could not be found.
[root@stack-centos8 vagrant]# systemctl status wazuh-manager
Unit wazuh-manager.service could not be found.
[root@stack-centos8 vagrant]# systemctl status wazuh-dashboard
Unit wazuh-dashboard.service could not be found.
[root@stack-centos8 vagrant]# ls -ltr /var/oseec
ls: cannot access '/var/oseec': No such file or directory
[root@stack-centos8 vagrant]#
Test Distributed 🟢
Test install Indexer 🟢 
[root@stack-centos8 vagrant]# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: 127.0.0.1
    #- name: node-2
    #  ip: "<indexer-node-ip>"
    #- name: node-3
    #  ip: "<indexer-node-ip>"

  # Wazuh server nodes
  # If there is more than one Wazuh server
  # node, each one must have a node_type
  server:
    - name: wazuh-1
      ip: 127.0.0.1
    #  node_type: master
    #- name: wazuh-2
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker
    #- name: wazuh-3
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker

  # Wazuh dashboard nodes
  dashboard:
    - name: dashboard
      ip: 127.0.0.1
[root@stack-centos8 vagrant]# bash wazuh-install.sh --generate-config-files
30/01/2025 21:06:10 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:06:10 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:06:10 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:06:10 INFO: --- Configuration files ---
30/01/2025 21:06:10 INFO: Generating configuration files.
30/01/2025 21:06:10 INFO: Generating the root certificate.
30/01/2025 21:06:10 INFO: Generating Admin certificates.
30/01/2025 21:06:10 INFO: Generating Wazuh indexer certificates.
30/01/2025 21:06:10 INFO: Generating Filebeat certificates.
30/01/2025 21:06:10 INFO: Generating Wazuh dashboard certificates.
30/01/2025 21:06:11 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
[root@stack-centos8 vagrant]# bash wazuh-install.sh --wazuh-indexer node-1
30/01/2025 21:06:19 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:06:19 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:06:19 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:06:20 WARNING: The system has Firewalld enabled. Please ensure that traffic is allowed on these ports: 9200, 9300.
30/01/2025 21:06:21 INFO: Wazuh repository added.
30/01/2025 21:06:21 INFO: --- Wazuh indexer ---
30/01/2025 21:06:21 INFO: Starting Wazuh indexer installation.
30/01/2025 21:07:43 INFO: Wazuh indexer installation finished.
30/01/2025 21:07:43 INFO: Wazuh indexer post-install configuration finished.
30/01/2025 21:07:43 INFO: Starting service wazuh-indexer.
30/01/2025 21:08:00 INFO: wazuh-indexer service started.
30/01/2025 21:08:00 INFO: Initializing Wazuh indexer cluster security settings.
30/01/2025 21:08:00 INFO: Wazuh indexer cluster initialized.
30/01/2025 21:08:00 INFO: Installation finished.
[root@stack-centos8 vagrant]# bash wazuh-install.sh --start-cluster
30/01/2025 21:09:35 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:09:35 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:09:35 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:09:38 INFO: Wazuh indexer cluster security configuration initialized.
30/01/2025 21:09:49 INFO: Updating the internal users.
30/01/2025 21:09:51 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
30/01/2025 21:10:02 INFO: Wazuh indexer cluster started.
[root@stack-centos8 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 21:08:00 UTC; 3min 57s ago
     Docs: https://documentation.wazuh.com
 Main PID: 22758 (java)
    Tasks: 75 (limit: 23684)
   Memory: 1.3G
   CGroup: /system.slice/wazuh-indexer.service
           └─22758 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPre>

Jan 30 21:07:45 stack-centos8 systemd-entrypoint[22758]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-inde>
Jan 30 21:07:45 stack-centos8 systemd-entrypoint[22758]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 30 21:07:45 stack-centos8 systemd-entrypoint[22758]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 21:07:46 stack-centos8 systemd-entrypoint[22758]: Jan 30, 2025 9:07:46 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Jan 30 21:07:46 stack-centos8 systemd-entrypoint[22758]: WARNING: COMPAT locale provider will be removed in a future release
Jan 30 21:07:46 stack-centos8 systemd-entrypoint[22758]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 30 21:07:46 stack-centos8 systemd-entrypoint[22758]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexe>
Jan 30 21:07:46 stack-centos8 systemd-entrypoint[22758]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 30 21:07:46 stack-centos8 systemd-entrypoint[22758]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 21:08:00 stack-centos8 systemd[1]: Started wazuh-indexer.

[root@stack-centos8 vagrant]# tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'admin\'" -A 1
  indexer_username: 'admin'
  indexer_password: 'xxxxxxxxxxx'
[root@stack-centos8 vagrant]# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-indexer-cluster",
  "cluster_uuid" : "z7TlYXFcR5yBStDGPzftFw",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "20f04b54e84e90747c861bde395497f059929cea",
    "build_date" : "2025-01-17T12:56:25.512234Z",
    "build_snapshot" : false,
    "lucene_version" : "9.11.1",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}
[root@stack-centos8 vagrant]# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                               cluster_manager name
127.0.0.1           51          90   4    0.27    0.37     0.38 dimr      data,ingest,master,remote_cluster_client *               node-1
[root@stack-centos8 vagrant]#
Test install Server 🟢 
[root@stack-centos8 vagrant]# bash wazuh-install.sh --wazuh-server wazuh-1
30/01/2025 21:13:14 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:13:14 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:13:14 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:13:14 WARNING: The system has Firewalld enabled. Please ensure that traffic is allowed on these ports: 1514, 1515, 1516, 55000.
30/01/2025 21:13:14 INFO: Wazuh repository added.
30/01/2025 21:13:15 INFO: --- Wazuh server ---
30/01/2025 21:13:15 INFO: Starting the Wazuh manager installation.
30/01/2025 21:15:13 INFO: Wazuh manager installation finished.
30/01/2025 21:15:13 INFO: Wazuh manager vulnerability detection configuration finished.
30/01/2025 21:15:13 INFO: Starting service wazuh-manager.
30/01/2025 21:15:29 INFO: wazuh-manager service started.
30/01/2025 21:15:29 INFO: Starting Filebeat installation.
30/01/2025 21:15:36 INFO: Filebeat installation finished.
30/01/2025 21:15:37 INFO: Filebeat post-install configuration finished.
30/01/2025 21:15:38 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
30/01/2025 21:16:00 INFO: Starting service filebeat.
30/01/2025 21:16:00 INFO: filebeat service started.
30/01/2025 21:16:00 INFO: Installation finished.
[root@stack-centos8 vagrant]# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 21:15:58 UTC; 58s ago
    Tasks: 173 (limit: 23684)
   Memory: 1.8G
   CGroup: /system.slice/wazuh-manager.service
           ├─27347 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─27348 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─27351 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─27354 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─27396 /var/ossec/bin/wazuh-authd
           ├─27410 /var/ossec/bin/wazuh-db
           ├─27436 /var/ossec/bin/wazuh-execd
           ├─27451 /var/ossec/bin/wazuh-analysisd
           ├─27513 /var/ossec/bin/wazuh-syscheckd
           ├─27535 /var/ossec/bin/wazuh-remoted
           ├─27570 /var/ossec/bin/wazuh-logcollector
           ├─27588 /var/ossec/bin/wazuh-monitord
           └─27622 /var/ossec/bin/wazuh-modulesd

Jan 30 21:15:52 stack-centos8 env[27281]: Started wazuh-syscheckd...
Jan 30 21:15:53 stack-centos8 env[27281]: Started wazuh-remoted...
Jan 30 21:15:53 stack-centos8 env[27281]: Started wazuh-logcollector...
Jan 30 21:15:54 stack-centos8 env[27281]: Started wazuh-monitord...
Jan 30 21:15:54 stack-centos8 env[27281]: wazuh-modulesd: Process 27316 not used by Wazuh, removing...
Jan 30 21:15:54 stack-centos8 env[27281]: 2025/01/30 21:15:54 wazuh-modulesd:router: INFO: Loaded router module.
Jan 30 21:15:54 stack-centos8 env[27281]: 2025/01/30 21:15:54 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 30 21:15:55 stack-centos8 env[27281]: Started wazuh-modulesd...
Jan 30 21:15:58 stack-centos8 env[27281]: Completed.
Jan 30 21:15:58 stack-centos8 systemd[1]: Started Wazuh manager.
[root@stack-centos8 vagrant]# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
[root@stack-centos8 vagrant]#
Test install Dashboard 🟢 
[root@stack-centos8 vagrant]# bash wazuh-install.sh --wazuh-dashboard dashboard
30/01/2025 21:17:49 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 21:17:49 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 21:17:49 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 21:17:49 INFO: Wazuh web interface port will be 443.
30/01/2025 21:17:49 WARNING: The system has Firewalld enabled. Please ensure that traffic is allowed on this port: 443.
30/01/2025 21:17:49 INFO: Wazuh repository added.
30/01/2025 21:17:50 INFO: --- Wazuh dashboard ----
30/01/2025 21:17:50 INFO: Starting Wazuh dashboard installation.
30/01/2025 21:19:12 INFO: Wazuh dashboard installation finished.
30/01/2025 21:19:12 INFO: Wazuh dashboard post-install configuration finished.
30/01/2025 21:19:12 INFO: Starting service wazuh-dashboard.
30/01/2025 21:19:12 INFO: wazuh-dashboard service started.
30/01/2025 21:19:29 INFO: Initializing Wazuh dashboard web application.
30/01/2025 21:19:29 INFO: Wazuh dashboard web application initialized.
30/01/2025 21:19:29 INFO: --- Summary ---
30/01/2025 21:19:29 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: eGpOoq1TZC+rm0dT8CW3ZyJZ.kPepe2.
30/01/2025 21:19:29 INFO: Installation finished.
[root@stack-centos8 vagrant]# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
   Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 21:19:14 UTC; 24s ago
 Main PID: 29999 (node)
    Tasks: 11 (limit: 23684)
   Memory: 274.4M
   CGroup: /system.slice/wazuh-dashboard.service
           └─29999 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 30 21:19:21 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:21Z","tags":["info","plugins","wazuh","initialize"],"pid":29999,"messa>
Jan 30 21:19:21 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:21Z","tags":["error","opensearch","data"],"pid":29999,"message":"[Resp>
Jan 30 21:19:21 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:21Z","tags":["error","opensearch","data"],"pid":29999,"message":"[Resp>
Jan 30 21:19:21 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:21Z","tags":["listening","info"],"pid":29999,"message":"Server running>
Jan 30 21:19:21 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:21Z","tags":["info","http","server","OpenSearchDashboards"],"pid":2999>
Jan 30 21:19:21 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:21Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":29999,"m>
Jan 30 21:19:21 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:21Z","tags":["info","plugins","wazuh","monitoring"],"pid":29999,"messa>
Jan 30 21:19:22 stack-centos8 opensearch-dashboards[29999]: {"type":"log","@timestamp":"2025-01-30T21:19:22Z","tags":["error","plugins","wazuh","monitoring"],"pid":29999,"mess>
Jan 30 21:19:29 stack-centos8 opensearch-dashboards[29999]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout >
Jan 30 21:19:29 stack-centos8 opensearch-dashboards[29999]: {"type":"response","@timestamp":"2025-01-30T21:19:29Z","tags":[],"pid":29999,"method":"get","statusCode":200,"req":>

[root@stack-centos8 vagrant]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2025-01-29 15:59:26 UTC; 1 day 5h ago
     Docs: man:firewalld(1)
 Main PID: 919 (firewalld)
    Tasks: 2 (limit: 23684)
   Memory: 23.1M
   CGroup: /system.slice/firewalld.service
           └─919 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid

Jan 29 15:59:25 stack-centos8 systemd[1]: Starting firewalld - dynamic firewall daemon...
Jan 29 15:59:26 stack-centos8 systemd[1]: Started firewalld - dynamic firewall daemon.
[root@stack-centos8 vagrant]#

Image

Test Offline 🟢
Download package 🟢
  • Validations of new param:
[root@stack-centos8 vagrant]# bash wazuh-install.sh -dw rpm
30/01/2025 22:00:56 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 22:00:56 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 22:00:56 ERROR: To download the packages it is necessary to set the architecture in -da|--download-arch <amd64|x86_64|arm64|aarch64>
[root@stack-centos8 vagrant]# bash wazuh-install.sh -dw rpm -da amd65
30/01/2025 22:01:04 ERROR: Error on arguments. Probably missing <amd64|x86_64|arm64|aarch64> after -da|--download-arch

NAME
        wazuh-install.sh - Install and configure Wazuh central components: Wazuh server, Wazuh indexer, and Wazuh dashboard.

SYNOPSIS
        wazuh-install.sh [OPTIONS] -a | -c | -s | -wi <indexer-node-name> | -wd <dashboard-node-name> | -ws <server-node-name>

DESCRIPTION
        -a,  --all-in-one
                Install and configure Wazuh server, Wazuh indexer, Wazuh dashboard.

        -c,  --config-file <path-to-config-yml>
                Path to the configuration file used to generate wazuh-install-files.tar file containing the files that will be needed for installation. By default, the Wazuh installation assistant will search for a file named config.yml in the same path as the script.

        -d [pre-release|staging],  --development
                Use development repositories. By default it uses the pre-release package repository. If staging is specified, it will use that repository.

        -dw,  --download-wazuh <deb|rpm>
                Download all the packages necessary for offline installation. Type of packages to download for offline installation (rpm, deb)

        -da,  --download-arch <amd64|arm64|x86_64|aarch64>
                Define the architecture of the packages to download for offline installation.

        -fd,  --force-install-dashboard
                Force Wazuh dashboard installation to continue even when it is not capable of connecting to the Wazuh indexer.

        -g,  --generate-config-files
                Generate wazuh-install-files.tar file containing the files that will be needed for installation from config.yml. In distributed deployments you will need to copy this file to all hosts.

        -h,  --help
                Display this help and exit.

        -i,  --ignore-check
                Ignore the check for minimum hardware requirements.

        -o,  --overwrite
                Overwrites previously installed components. This will erase all the existing configuration and data.

        -of,  --offline-installation
                Perform an offline installation. This option must be used with -a, -ws, -s, -wi, or -wd.

        -p,  --port
                Specifies the Wazuh web user interface port. By default is the 443 TCP port. Recommended ports are: 8443, 8444, 8080, 8888, 9000.

        -s,  --start-cluster
                Initialize Wazuh indexer cluster security settings.

        -t,  --tar <path-to-certs-tar>
                Path to tar file containing certificate files. By default, the Wazuh installation assistant will search for a file named wazuh-install-files.tar in the same path as the script.

        -u,  --uninstall
                Uninstalls all Wazuh components. This will erase all the existing configuration and data.

        -v,  --verbose
                Shows the complete installation output.

        -V,  --version
                Shows the version of the script and Wazuh packages.

        -wd,  --wazuh-dashboard <dashboard-node-name>
                Install and configure Wazuh dashboard, used for distributed deployments.

        -wi,  --wazuh-indexer <indexer-node-name>
                Install and configure Wazuh indexer, used for distributed deployments.

        -ws,  --wazuh-server <server-node-name>
                Install and configure Wazuh manager and Filebeat, used for distributed deployments.
[root@stack-centos8 vagrant]# bash wazuh-install.sh -dw deb -da x86_64
30/01/2025 22:01:34 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 22:01:34 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 22:01:34 ERROR: Architecture x86_64 not valid for package type deb
[root@stack-centos8 vagrant]# bash wazuh-install.sh -dw deb -da aarch64
30/01/2025 22:01:40 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 22:01:40 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 22:01:40 ERROR: Architecture aarch64 not valid for package type deb
[root@stack-centos8 vagrant]#
  • Download packages:

[root@stack-centos8 vagrant]# bash wazuh-install.sh -dw rpm -da x86_64 -v
30/01/2025 22:55:45 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 22:55:45 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 22:55:45 DEBUG: YUM package manager will be used.
30/01/2025 22:55:45 DEBUG: Installing check dependencies.
30/01/2025 22:55:45 DEBUG: Checking Wazuh installation.
30/01/2025 22:55:45 DEBUG: Checking system architecture.
30/01/2025 22:55:45 DEBUG: System architecture: x86_64
30/01/2025 22:55:45 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 22:55:45 DEBUG: CPU cores detected: 4
30/01/2025 22:55:45 DEBUG: Free RAM memory detected: 3736
30/01/2025 22:55:45 INFO: --- Download Packages ---
30/01/2025 22:55:45 INFO: Starting Wazuh packages download.
30/01/2025 22:55:45 INFO: Downloading Wazuh rpm packages for x86_64.
30/01/2025 22:55:47 DEBUG: Wazuh manager package revision fetched.
30/01/2025 22:55:49 DEBUG: Wazuh indexer package revision fetched.
30/01/2025 22:55:51 DEBUG: Wazuh dashboard package revision fetched.
30/01/2025 22:55:51 DEBUG: Downloading Wazuh manager package...
30/01/2025 22:56:00 INFO: The manager package was downloaded.
30/01/2025 22:56:00 DEBUG: Downloading Wazuh filebeat package...
30/01/2025 22:56:01 INFO: The filebeat package was downloaded.
30/01/2025 22:56:01 DEBUG: Downloading Wazuh indexer package...
30/01/2025 22:56:21 INFO: The indexer package was downloaded.
30/01/2025 22:56:21 DEBUG: Downloading Wazuh dashboard package...
30/01/2025 22:56:26 INFO: The dashboard package was downloaded.
30/01/2025 22:56:26 INFO: The packages are in wazuh-offline/wazuh-packages
30/01/2025 22:56:26 INFO: Downloading configuration files and assets.
30/01/2025 22:56:26 DEBUG: Downloading https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH...
30/01/2025 22:56:27 INFO: The resource https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH was downloaded.
30/01/2025 22:56:27 DEBUG: Downloading https://packages-dev.wazuh.com/idr1887/4.12/tpl/wazuh/filebeat/filebeat.yml...
30/01/2025 22:56:28 INFO: The resource https://packages-dev.wazuh.com/idr1887/4.12/tpl/wazuh/filebeat/filebeat.yml was downloaded.
30/01/2025 22:56:28 DEBUG: Downloading https://raw.githubusercontent.com/wazuh/wazuh/4.12.0/extensions/elasticsearch/7.x/wazuh-template.json...
30/01/2025 22:56:28 INFO: The resource https://raw.githubusercontent.com/wazuh/wazuh/4.12.0/extensions/elasticsearch/7.x/wazuh-template.json was downloaded.
30/01/2025 22:56:28 DEBUG: Downloading https://packages-dev.wazuh.com/idr1887/pre-release/filebeat/wazuh-filebeat-0.4.tar.gz...
30/01/2025 22:56:29 INFO: The resource https://packages-dev.wazuh.com/idr1887/pre-release/filebeat/wazuh-filebeat-0.4.tar.gz was downloaded.
30/01/2025 22:56:29 INFO: The configuration files and assets are in wazuh-offline.tar.gz
30/01/2025 22:57:13 INFO: You can follow the installation guide here https://documentation.wazuh.com/current/deployment-options/offline-installation.html
[root@stack-centos8 vagrant]#
[root@stack-centos8 vagrant]# ls -ltr
total 1452292
-rw-------. 1 root root      11017 Jan 30 21:47 wazuh-install-files.tar
-rw-------. 1 root root 1486936342 Jan 30 23:05 wazuh-offline.tar.gz
-rw-r--r--. 1 root root     193517 Jan 30 23:05 wazuh-install.sh
[root@stack-centos8 vagrant]#
Install offline 🟢
  • Wazuh indexer

[root@stack-centos8 vagrant]# bash wazuh-install.sh --offline-installation --wazuh-indexer node-1
30/01/2025 23:10:02 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:10:02 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:10:02 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:10:04 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:10:05 INFO: Checking prerequisites for Offline installation.
30/01/2025 23:10:05 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:10:12 INFO: --- Wazuh indexer ---
30/01/2025 23:10:12 INFO: Starting Wazuh indexer installation.
30/01/2025 23:10:25 INFO: Wazuh indexer installation finished.
30/01/2025 23:10:25 INFO: Wazuh indexer post-install configuration finished.
30/01/2025 23:10:25 INFO: Starting service wazuh-indexer.
30/01/2025 23:10:38 INFO: wazuh-indexer service started.
30/01/2025 23:10:38 INFO: Initializing Wazuh indexer cluster security settings.
30/01/2025 23:10:39 INFO: Wazuh indexer cluster initialized.
30/01/2025 23:10:39 INFO: Installation finished.
[root@stack-centos8 vagrant]# bash wazuh-install.sh --offline-installation --start-cluster
30/01/2025 23:14:05 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:14:05 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:14:05 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:14:07 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:14:07 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:14:10 INFO: Wazuh indexer cluster security configuration initialized.
30/01/2025 23:14:26 INFO: Updating the internal users.
30/01/2025 23:14:29 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
30/01/2025 23:14:39 INFO: Wazuh indexer cluster started.
[root@stack-centos8 vagrant]#
[root@stack-centos8 vagrant]# tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'admin\'" -A 1
  indexer_username: 'admin'
  indexer_password: 'xxxxxxxxxxx'
[root@stack-centos8 vagrant]# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-indexer-cluster",
  "cluster_uuid" : "lmcAY_xdQH6V2dgZsUZK2g",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "20f04b54e84e90747c861bde395497f059929cea",
    "build_date" : "2025-01-17T12:56:25.512234Z",
    "build_snapshot" : false,
    "lucene_version" : "9.11.1",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}
[root@stack-centos8 vagrant]# curl -k -u admin:xxxxxxxxxxx https://127.0.0.1:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                               cluster_manager name
127.0.0.1           24          93   3    0.27    0.32     0.20 dimr      data,ingest,master,remote_cluster_client *               node-1
[root@stack-centos8 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 23:10:38 UTC; 6min ago
     Docs: https://documentation.wazuh.com
 Main PID: 33656 (java)
    Tasks: 78 (limit: 23684)
   Memory: 1.3G
   CGroup: /system.slice/wazuh-indexer.service
           └─33656 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPre>

Jan 30 23:10:27 stack-centos8 systemd-entrypoint[33656]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-inde>
Jan 30 23:10:27 stack-centos8 systemd-entrypoint[33656]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 30 23:10:27 stack-centos8 systemd-entrypoint[33656]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 23:10:27 stack-centos8 systemd-entrypoint[33656]: Jan 30, 2025 11:10:27 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Jan 30 23:10:27 stack-centos8 systemd-entrypoint[33656]: WARNING: COMPAT locale provider will be removed in a future release
Jan 30 23:10:28 stack-centos8 systemd-entrypoint[33656]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 30 23:10:28 stack-centos8 systemd-entrypoint[33656]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexe>
Jan 30 23:10:28 stack-centos8 systemd-entrypoint[33656]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 30 23:10:28 stack-centos8 systemd-entrypoint[33656]: WARNING: System::setSecurityManager will be removed in a future release
Jan 30 23:10:38 stack-centos8 systemd[1]: Started wazuh-indexer.

[root@stack-centos8 vagrant]#
  • Wazuh manager
[root@stack-centos8 vagrant]# bash wazuh-install.sh --offline-installation --wazuh-server wazuh-1
30/01/2025 23:19:43 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:19:43 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:19:44 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:19:46 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:19:46 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:19:47 INFO: --- Wazuh server ---
30/01/2025 23:19:47 INFO: Starting the Wazuh manager installation.
30/01/2025 23:21:08 INFO: Wazuh manager installation finished.
30/01/2025 23:21:08 INFO: Wazuh manager vulnerability detection configuration finished.
30/01/2025 23:21:08 INFO: Starting service wazuh-manager.
30/01/2025 23:21:22 INFO: wazuh-manager service started.
30/01/2025 23:21:22 INFO: Starting Filebeat installation.
30/01/2025 23:21:23 INFO: Filebeat installation finished.
30/01/2025 23:21:23 INFO: Filebeat post-install configuration finished.
30/01/2025 23:21:24 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
30/01/2025 23:21:48 INFO: Starting service filebeat.
30/01/2025 23:21:48 INFO: filebeat service started.
30/01/2025 23:21:48 INFO: Installation finished.
[root@stack-centos8 vagrant]# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 23:21:45 UTC; 47s ago
    Tasks: 173 (limit: 23684)
   Memory: 1.6G
   CGroup: /system.slice/wazuh-manager.service
           ├─38027 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─38028 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─38031 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─38034 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─38076 /var/ossec/bin/wazuh-authd
           ├─38093 /var/ossec/bin/wazuh-db
           ├─38119 /var/ossec/bin/wazuh-execd
           ├─38134 /var/ossec/bin/wazuh-analysisd
           ├─38200 /var/ossec/bin/wazuh-syscheckd
           ├─38215 /var/ossec/bin/wazuh-remoted
           ├─38250 /var/ossec/bin/wazuh-logcollector
           ├─38270 /var/ossec/bin/wazuh-monitord
           └─38311 /var/ossec/bin/wazuh-modulesd

Jan 30 23:21:39 stack-centos8 env[37960]: Started wazuh-syscheckd...
Jan 30 23:21:40 stack-centos8 env[37960]: Started wazuh-remoted...
Jan 30 23:21:41 stack-centos8 env[37960]: Started wazuh-logcollector...
Jan 30 23:21:42 stack-centos8 env[37960]: Started wazuh-monitord...
Jan 30 23:21:42 stack-centos8 env[37960]: wazuh-modulesd: Process 37996 not used by Wazuh, removing...
Jan 30 23:21:42 stack-centos8 env[37960]: 2025/01/30 23:21:42 wazuh-modulesd:router: INFO: Loaded router module.
Jan 30 23:21:42 stack-centos8 env[37960]: 2025/01/30 23:21:42 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 30 23:21:43 stack-centos8 env[37960]: Started wazuh-modulesd...
Jan 30 23:21:45 stack-centos8 env[37960]: Completed.
Jan 30 23:21:45 stack-centos8 systemd[1]: Started Wazuh manager.
[root@stack-centos8 vagrant]# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
[root@stack-centos8 vagrant]#
  • Wazuh dashboard
[root@stack-centos8 vagrant]# bash wazuh-install.sh --offline-installation --wazuh-dashboard dashboard
30/01/2025 23:23:30 INFO: Starting Wazuh installation assistant. Wazuh version: 4.12.0
30/01/2025 23:23:30 INFO: Verbose logging redirected to /var/log/wazuh-install.log
30/01/2025 23:23:30 INFO: Checking dependencies for Wazuh installation assistant.
30/01/2025 23:23:32 INFO: Verifying that your system meets the recommended minimum hardware requirements.
30/01/2025 23:23:32 INFO: Wazuh web interface port will be 443.
30/01/2025 23:23:33 INFO: Checking prerequisites for Offline installation.
30/01/2025 23:23:34 INFO: Checking wazuh-offline.tar.gz file.
30/01/2025 23:23:34 INFO: --- Wazuh dashboard ----
30/01/2025 23:23:34 INFO: Starting Wazuh dashboard installation.
30/01/2025 23:24:35 INFO: Wazuh dashboard installation finished.
30/01/2025 23:24:35 INFO: Wazuh dashboard post-install configuration finished.
30/01/2025 23:24:35 INFO: Starting service wazuh-dashboard.
30/01/2025 23:24:35 INFO: wazuh-dashboard service started.
30/01/2025 23:24:52 INFO: Initializing Wazuh dashboard web application.
30/01/2025 23:24:53 INFO: Wazuh dashboard web application initialized.
30/01/2025 23:24:53 INFO: --- Summary ---
30/01/2025 23:24:53 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: 44.gaGYMIaA0gogt*y+lmR6Bb46xRGb7
30/01/2025 23:24:53 INFO: Installation finished.
[root@stack-centos8 vagrant]# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
   Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2025-01-30 23:24:37 UTC; 2min 1s ago
 Main PID: 40137 (node)
    Tasks: 11 (limit: 23684)
   Memory: 200.2M
   CGroup: /system.slice/wazuh-dashboard.service
           └─40137 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 30 23:24:45 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:24:45Z","tags":["error","opensearch","data"],"pid":40137,"message":"[Resp>
Jan 30 23:24:45 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:24:45Z","tags":["info","plugins","wazuh","monitoring"],"pid":40137,"messa>
Jan 30 23:24:45 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:24:45Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":40137,"m>
Jan 30 23:24:45 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:24:45Z","tags":["listening","info"],"pid":40137,"message":"Server running>
Jan 30 23:24:45 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:24:45Z","tags":["info","http","server","OpenSearchDashboards"],"pid":4013>
Jan 30 23:24:45 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:24:45Z","tags":["error","plugins","wazuh","monitoring"],"pid":40137,"mess>
Jan 30 23:24:52 stack-centos8 opensearch-dashboards[40137]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout >
Jan 30 23:24:53 stack-centos8 opensearch-dashboards[40137]: {"type":"response","@timestamp":"2025-01-30T23:24:52Z","tags":[],"pid":40137,"method":"get","statusCode":200,"req":>
Jan 30 23:25:01 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:25:01Z","tags":["error","opensearch","data"],"pid":40137,"message":"[reso>
Jan 30 23:25:01 stack-centos8 opensearch-dashboards[40137]: {"type":"log","@timestamp":"2025-01-30T23:25:01Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":40137,"m>

[root@stack-centos8 vagrant]#

Image

@wazuhci wazuhci moved this from In progress to Pending review in XDR+SIEM/Release 4.12.0 Jan 30, 2025
@wazuhci wazuhci moved this from Pending review to Done in XDR+SIEM/Release 4.12.0 Jan 31, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@fcaffieri fcaffieri

Labels
level/task Task issue type/enhancement Enhancement issue
Projects
XDR+SIEM/Release 4.12.0
Status: Done
Milestone
No milestone
3 participants
@teddytpc1 @c-bordon @fcaffieri