shapeshiftr

Build & install Wazuh Agent (latest) on Unraid / Slackware (Unraid OS 7.1) What you’ll getA compiled and installed Wazuh agent under /var/ossec Agent configured to talk TCP/1514 to your Wazuh manager A quick path to enroll and resolve common “never connected” issues Prereqs (Unraid)Make sure you have the basic build toolchain: gcc, g++, make, cmake, curl (install via your usual Unraid method, e.g., DevPack/Un-get) Install the attr headers (for attr/xattr.h): cd /root wget https://mirrors.slackware.com/slackware/slackware64-current/slackware64/a/attr-*.txz installpkg attr-*.txz Network: the agent must reach your manager on: 1514/tcp (agent <-> manager) 1515/tcp (enrollment via wazuh-authd) Quick copy-paste: fetch latest, patch, build & install # 1) Work in /root cd /root # 2) Pull the latest Wazuh release tarball from GitHub LATEST=$(curl -s https://api.github.com/repos/wazuh/wazuh/releases/latest \ | grep '"tarball_url"' | cut -d '"' -f 4) curl -L -o wazuh-latest.tar.gz "$LATEST" # 3) Extract and enter the source folder tar -xzf wazuh-latest.tar.gz cd wazuh-*/ # 4) Toolchain quirks on Slackware/GCC 15: # - Enforce C++17 # - Ensure <cstdint> types are visible everywhere they’re used export CC=gcc CXX=g++ export CXXFLAGS="$CXXFLAGS -std=gnu++17 -include cstdint" # 5) (One-time header includes) Some headers use uint32_t/uint64_t/uint8_t # without including <cstdint>. Add it to the few files that need it. sed -i '1i #include <cstdint>' \ src/shared_modules/dbsync/src/sqlite/isqlite_wrapper.h \ src/shared_modules/dbsync/src/sqlite/sqlite_wrapper.h \ src/shared_modules/utils/stringHelper.h # 6) If you rerun the installer, clean stale builds first (safe to run anytime) rm -rf src/data_provider/build src/shared_modules/dbsync/build # 7) Install (interactive) ./install.sh # - Select: agent # - Install dir: /var/ossec (default) # - Manager address: <your-manager FQDN or IP> # - Protocol: tcp (default) # - Leave other defaults unless you have a reason to change If the build finishes, you’ll see “Done building agent” and final instructions. Start the agent/var/ossec/bin/wazuh-control start Check the agent log: tail -f /var/ossec/logs/ossec.log You should see it trying to enroll, then connecting to the manager. Enrollment & “never connected” fixes1) Confirm the agent actually received a key On the agent: test -s /var/ossec/etc/client.keys && echo "client.keys present" || echo "NO client.keys" If present → the agent has enrolled. If missing → the agent hasn’t enrolled yet. 2) Make sure the manager is allowing enrollment On the manager, your <auth> block (in ossec.conf) must be enabled, listening on 1515, and (if you don’t use passwords) use_password should be no. Example: <auth> <disabled>no</disabled> <port>1515</port> <use_password>no</use_password> <purge>yes</purge> </auth> Restart the manager if you change this. 3) Duplicate agent name = common cause of failure If you previously forwarded syslog or enrolled this host before, the manager may already have an entry for srv-01 (example). Symptoms on the manager: wazuh-authd: WARNING: Duplicate name '<name>', rejecting enrollment. Fix on the manager (pick one): In the Wazuh Dashboard → Agents → delete/replace the old agent, or CLI: /var/ossec/bin/manage_agents → Remove the old agent with the same name. Then, back on the agent, restart: /var/ossec/bin/wazuh-control restart Watch the log again: tail -f /var/ossec/logs/ossec.log 4) If you still have no key Enroll manually from the agent: /var/ossec/bin/agent-auth -m <manager_fqdn_or_ip> /var/ossec/bin/wazuh-control restart Verify it’s healthyclient.keys exists on the agent Agent log shows a successful connection In the Wazuh Dashboard, the agent status is Active You see inventory (syscollector), FIM (syscheck) and logs flowing in Notes & rationale (why these steps)attr/xattr.h: Wazuh’s build and/or runtime touches extended attributes; Slackware needs the attr package installed for headers. GCC 15 + Slackware: Some C++ sources rely on fixed-width types without explicitly including <cstdint>. Adding the include and compiling with GNU++17 avoids compile errors like: ‘uint64_t’ does not name a type ‘uint8_t’ does not name a type Cleaning build dirs: If you tweak headers or flags and re-run, clear src/data_provider/build and src/shared_modules/dbsync/build so CMake reconfigures cleanly. Duplicate agent entries: The manager rejects new enrollments if an agent with the same name is still registered and not yet purged. Delete/replace it first. Uninstall / re-run (optional)If you want to nuke it and try again: /var/ossec/bin/wazuh-control stop rm -rf /var/ossec # Then redo the build/install steps above.

Brilliant, thank you (and JorgeB)!

Long story short, one of my disks is in a pre-pre-failure status and I have the ability to RMA the drive. My current drive configuration: Parity = Healthy Disk 1 = Unhealthy Disk 2 = Healthy I am willing to run without data protection for the duration of the RMA, as it's replaceable data. What is the best process to use to pull the current parity disk out, convert it to a "data disk" and copy the existing data off the failing "Disk 1" to this drive? As a follow-up -- when I get the RMA'd drive, is it as simple as stopping the array, selecting the replaced disk as "Parity" and letting the array rebuild? TIA.

Unless I'm seeing something different to you, the only place I can see power settings in the NUT config section of Unraid -> Settings is in CLI for "/etc/nut/upsmon.conf" MONITOR [email protected] 1 monuser monpass master SHUTDOWNCMD "/sbin/poweroff" POWERDOWNFLAG /etc/nut/no_killpower NOTIFYFLAG ONBATT SYSLOG+EXEC NOTIFYFLAG ONLINE SYSLOG+EXEC NOTIFYCMD "/usr/sbin/nut-notify" Didn't there used to be a GUI option to configure this, or am I just misremembering?

Migrated from the legacy NUT plugin, and all is working fine -- but I can't see where the "automatic shutdown" options have been moved to. If I'm not mistaken, the legacy plugin had support for this. Am I just blind? Is there any way to enable auto-shutdown of the local Unraid host as a UPS battery percentage level? Does anyone know how to trigger Unraid's graceful shutdown, versus a generic power-off that may not wait for Docker/VMs to shutdown and unmount the array first?

That's what I thought too, however I tried toggling it on/off as per the guide with no change. Try switching on or off any Fast Boot feature. Ref: https://wiki.unraid.net/Articles/Getting_Started#Manual_Install_Method

BIOS is latest, made sure of that and also reflashed after reconfiguration just in case unfortunately 😔 Anyway, I've thrown in the towel and given up. Moving to a spare rig I had that the Mrs was using and transplating a bunch of components. Would have been nice to have 10/20 cores but will go with the i5 12400F instead. Also solves my issue with needing a third M2 slot, so it's not a complete loss. Thanks for your help. I guess this one remains unsolved 🤷🏻‍♂️

Further down the rabbithole, if I use Rufus to burn the Ubuntu ISO to a spare HDD, and connect this via SATA (to remove anything relating to USB boot, compatibility, etc.) I get the same exact result. Hangs after the "Try or Install Ubuntu" option in GRUB. I'm almost ready to give up and I'd be suspecting a hardware fault, except for the fact that I can boot and run Windows 11 without a single issue. I have never seen anything like this before 🤦🏻‍♂️

Just to follow up, I can boot both Ubuntu and unRAID USB sticks from another machine without issue -- so that means it's just something weird with this new system I'm trying to migrate to. CPU: Intel 10900k MB: Gigabyte Z590 Vision D It's just so odd that it can boot Windows 11 install media cleanly, but anything *nix it immediately hangs after GRUB is used.

I've tried them all at this stage -- don't think this motherboard has USB 2.0 specifically, nor any way to disable the USB 3.x ports. Good point, but no. I just tried putting Ubuntu on a USB via Rufus and I get the initial splash screen where I can hit "try Ubuntu", but immediately blank afterwards. This is the same behaviour as unRAID, so I don't think it's unRAID specific. Weirdly on that PC I can put Windows 11 on USB, boot, install and use the OS without issue. .. This is really confusing. The USB in question came out of the working unRAID server before I rebuilt, so yes. However I flashed it since during testing. Will give it a go on another system now.

Settings for non-UEFI:

No dice, unfortunately. UEFI mode still does the same thing, legacy just goes to a blank screen and sits there. Tried with 2 USB sticks now, created on both Windows/MacOS -- have also tried v6.10.3. Fast boot makes no difference to either mode. Don't suppose you have any other ideas?

Hey guys, I could use a hand. I replaced CPU/MB/RAM recently and am moving Unraid to a new setup. Struggling with getting Unraid to even boot though. I have all storage unplugged, running on iGPU instead of discrete and a single stick of (known good) RAM. To troubleshoot, I put a spare M2 ssd in the box and installed windows 11 - this seems to work fine, however Unraid freezes during boot as shown. It doesn’t write any logs to the USB so I’m confused as to what’s going on. I also used the usb creation tool to flash this USB with the latest Unraid and it should be running completely vanilla latest version. Any pointers? I’m probably 8 hours deep of trying various combinations of hardware and BIOS settings at this stage and I’m starting to get desperate. Already swapped RAM, reflashed BIOS, tried with and without CSM support and legacy vs. UEFI options. Running a 10900k on a Gigabyte Aorus Vision D X590 board. I’m almost certain the hardware layer is fine, I can run Prime95 in Windows 11 and everything is good.. Just unRAID is sticky for some reason.