Anna Tuen

Well, took me about an hour to work this one out - was a lot easier than expected Added wazuh user in the GUI Created a VM image of slackware 15 - installed standard developer tools. Downloaded the wazuh agent source file - https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-agent/index.html Ran the build etc. Installed on sample slackware instance Tweaked the ossec.conf for my environment and stuck the client.key into the client.keys file. Zipped up and copied to N1 Create an ossec directory on the share (saves all that re-installing from scratch every boot). Extracted files from zip file. Set client.keys to new key for the N1 Downloaded user.scripts plugin. Created new script to startup wazuh-agent - to run after array is up which you can do with user.scripts (way cool!). /usr/sbin/groupadd -g 999 wazuh (coz that's what the build sets the group permission to - but may change for you) /usr/sbin/usermod -f -a wazuh wazuh /mnt/user/tools/ossec/bin/wazuh-control start This worked for me and didn't have to worry about loss of queue files etc. Hope that helps others.

I have only just got an UnRAID device but have been leveraging wazuh for... err... about a decade for large international companies so.... My UnRAID device (a LincStation N1) basically trashes the root system every boot and reconstructs from flash. Cool for protecting the system as any changes get overwritten at boot, but a right PITA for persistant programmes, like wazuh agent. The option I am working on is... a) Build a slackware package from the wazuh agent source files (see alternative installs on their site), on a temp slackware server (VM of course) b) Build a plugin script to re-install the agent every boot. The problem is that "technically", all the historical tracking - like directory integrity - will be useless as its overwritten on boot - we're talking system area here, remember.... but practically, as its overwritten anyway... no biggie... one could cache the logs files but 'meh'. My issue will be maintaining a config file after reboots, but as I said, this is my first UnRAID box and its only been 24 hours. The idea of a wazuh manager is a non-starter coz without kibana and elastic, wazuh manager is a pain. If I got wazuh onto a synology box, I'm prtty confident I can get this thing to work.