Hello!

After a lot of trial and error, I succeed to compilate and install Wazuh. It's not really clean, but it's working. The hardest thing to set up is that the unraid OS is not persistent, so you need a script to set up files and services every time the server is restarted.

 

Step 1: Set Up Docker Container

1. Open Unraid GUI: Navigate to the Apps tab.
2. Search and Install: Look for "AutoSlackPack" and install the SpaceinvaderOne/AutoSlackPack Docker container.
3. Configure Container:
   1. Set the Autobuild package: environment variable to no.
   2. Map a host path (e.g., /mnt/user/appdata/wazuh-build) to /output in the container.

Step 2: Access and Compile Wazuh

1. Start the Container: Access its console.
2. Download Wazuh:

   curl -Lo wazuh-4.9.1.tar.gz https://github.com/wazuh/wazuh/archive/v4.9.1.tar.gz
   tar xzf wazuh-4.9.1.tar.gz
   cd wazuh-4.9.1

3. Install Wazuh: Run ./install.sh and choose /tmp/wazuh-agent-install as the installation directory.
    

Step 3: Create Slackware Package

1. Prepare Package Description:

   mkdir -p /tmp/package/install
   cat > /tmp/package/install/slack-desc << EOF
   # HOW TO EDIT THIS FILE:
         |-----handy-ruler------------------------------------------------------|
   wazuh-agent: wazuh-agent (Wazuh Agent for endpoint security)
   wazuh-agent:
   wazuh-agent: The Wazuh agent is a security agent that performs system data
   wazuh-agent: collection and provides real-time protection for the monitored system.
   wazuh-agent:
   wazuh-agent: It communicates with the Wazuh server, sending data in near real-time
   wazuh-agent: through an encrypted and authenticated channel.
   wazuh-agent:
   wazuh-agent: Homepage: https://wazuh.com
   EOF

2. Build Package:

   cd /tmp/wazuh-agent-install
   /sbin/makepkg -l y -c n /tmp/wazuh-agent-4.9.1-unraid.txz

    

Step 4: Retrieve and Store Files

1. Copy Files to Output Directory:

   cp /tmp/wazuh-agent-4.9.1-unraid.txz /output/
   cp /tmp/wazuh-agent-install/etc/ossec.conf /output/

    

2. Exit Container and open terminal session on your Unraid host

3. Move Files to Boot Directory:
    

   cp /mnt/user/appdata/wazuh-build/wazuh-agent-4.9.1-unraid.txz /boot/config/plugins/
   cp /mnt/user/appdata/wazuh-build/ossec.conf /boot/config/plugins/

Step 5: Create Installation Script
Create a script at /boot/config/plugins/install_wazuh_agent.sh with the following content:

 

#!/bin/bash

# Set environment variable permanently
if ! grep -q "export WAZUH_HOME=" /boot/config/go; then
    echo "export WAZUH_HOME=/var/ossec" >> /boot/config/go
fi

# Set WAZUH_HOME for the current session
export WAZUH_HOME=/var/ossec

# Create wazuh group if it doesn't exist
if ! getent group wazuh > /dev/null 2>&1; then
    groupadd -r wazuh
fi

# Create wazuh user if it doesn't exist
if ! id wazuh > /dev/null 2>&1; then
    useradd -r -g wazuh -d /var/ossec -s /sbin/nologin wazuh
fi

# Install the Wazuh agent package
installpkg /boot/config/plugins/wazuh-agent-4.9.1-unraid.txz

# Ensure proper permissions
chown -R wazuh:wazuh /var/ossec

# Create a symlink for the configuration file
if [ ! -f /boot/config/plugins/ossec.conf ]; then
    cp /var/ossec/etc/ossec.conf /boot/config/plugins/ossec.conf
fi
ln -sf /boot/config/plugins/ossec.conf /etc/ossec.conf

# Create the rc.wazuh-agent script
cat > /etc/rc.d/rc.wazuh-agent << EOF
#!/bin/sh

# Copyright (C) 2015, Wazuh Inc.
# OSSEC         Controls Wazuh
# Author:       Daniel B. Cid <dcid@ossec.net>
# Modified for slackware by Jack S. Lai

WAZUH_HOME=/var/ossec
WAZUH_CONTROL="\$WAZUH_HOME/bin/wazuh-control"

start() {
    \${WAZUH_CONTROL} start
}

stop() {
    \${WAZUH_CONTROL} stop
}

status() {
    \${WAZUH_CONTROL} status
}

case "\$1" in
start)
    start
    ;;
stop)
    stop
    ;;
restart)
    stop
    start
    ;;
status)
    status
    ;;
*)
    echo "*** Usage: \$0 {start|stop|restart|status}"
    exit 1
esac

exit 0
EOF

# Make the rc.wazuh-agent script executable
chmod +x /etc/rc.d/rc.wazuh-agent

# Start the Wazuh agent
/etc/rc.d/rc.wazuh-agent start

Script Breakdown

Set Environment Variable Permanently:

• Checks if WAZUH_HOME is already set in /boot/config/go.
• If not, it appends export WAZUH_HOME=/var/ossec to ensure it's set on every boot.

Set Environment Variable for Current Session:

• Exports WAZUH_HOME=/var/ossec for the current session, making it immediately available.

Create Wazuh Group:

• Checks if the wazuh group exists. If not, it creates it with groupadd.

Create Wazuh User:

• Checks if the wazuh user exists. If not, it creates the user with:
  • Home directory: /var/ossec
  • Shell: /sbin/nologin
  • Group: wazuh

Install Wazuh Agent Package:

• Installs the package located at /boot/config/plugins/wazuh-agent-4.9.1-unraid.txz using installpkg.

Set Permissions:

• Changes ownership of /var/ossec to the wazuh user and group to ensure proper access rights.

Create Symlink for Configuration File:

• Copies ossec.conf to /boot/config/plugins if it doesn't exist there.
• Creates a symbolic link from /boot/config/plugins/ossec.conf to /etc/ossec.conf.

Create rc.wazuh-agent Script:

• Writes a control script to /etc/rc.d/rc.wazuh-agent for managing the Wazuh agent service.
• The script includes functions to start, stop, and check the status of the agent.

Make Script Executable:

• Sets execute permissions on /etc/rc.d/rc.wazuh-agent.

Start Wazuh Agent:

• Executes the start function of the control script to launch the Wazuh agent.

Step 6: Make Script Executable and Persistent

chmod +x /boot/config/plugins/install_wazuh_agent.sh

Add these lines to /boot/config/go to run at startup:

export WAZUH_HOME=/var/ossec
bash /boot/config/plugins/install_wazuh_agent.sh

Feel free to ask any questions or provide feedback!

Edited October 22, 20241 yr by Ecosphere7903

Thanks a lot, have you done any change in the scripts or anything? Or should I go with this?

Not sure what I missed.  Here is the install error I get.

 

root@Tower:~# bash /boot/config/plugins/install_wazuh_agent.sh
Verifying package wazuh-agent-4.9.1-unraid.txz.
Installing package wazuh-agent-4.9.1-unraid.txz:
PACKAGE DESCRIPTION:
Package wazuh-agent-4.9.1-unraid.txz installed.
chown: cannot access '/var/ossec': No such file or directory
/etc/rc.d/rc.wazuh-agent: line 12: /var/ossec/bin/wazuh-control: No such file or directory

 

This solution is much more streamlined then my previous solution for testing that required another VM to build and pull files from and never spent time getting it to persist through a reboot but i found some issues in the original script on my system (7.0.0 original script may work on previous versions). I initially changed a bunch of things but to stay closer to Ecosphere7903 original posted solution, which i think is better than mine, i reinstalled with minimal changes to the original instructions to get it to work.

 

1. I noticed initially that, like kizeren, the /var/ossec directory was never created so add:

   # Ensure /var/ossec directory exists
   if [ ! -d "/var/ossec" ]; then
       mkdir -p /var/ossec
   fi
   
   # Ensure proper permissions
   chown -R wazuh:wazuh /var/ossec

   This check to see if the directory exist and if not create it

   1. you can also add:
       

      useradd -r -g wazuh -m -d /var/ossec -s /sbin/nologin wazuh

      useradd doesn't by default create the directory if it doesn't exist but just add -m flag and it will

2. After that i noticed that the install is putting the files in /bin instead /var/ossec/bin. You can check if this is happening using a find command and see where the files are. If the same issue occurs there is a few solutions, but the easiest is you can either update the script to move the files after the install to the correct directory or change the installpkg to include an installation directory:
    

   installpkg --root /var/ossec /boot/config/plugins/wazuh-agent-4.9.1-unraid.txz

 

After these updates the script runs fine and appears in the wazuh UI under agents.

 

I also run the install script using the plugin user scripts so i have more control over it and set to run after the array starts but adding it to the /boot/config/go gets the same result.

For the clueless one whose knowledge and understanding is barely scratching the surface - 

Wazuh provide instructions for deployment and installation of the docker, is that not applicable to Unraid environment? 

1 hour ago, zona said:

For the clueless one whose knowledge and understanding is barely scratching the surface - 

Wazuh provide instructions for deployment and installation of the docker, is that not applicable to Unraid environment? 

But still you have to install an agent in the host if you want to monitor unRAID.

If I remember well the docker instructions are for the wazuh platform, webui etc

Have to?

(let the container read the host resources, keeps host clean from modifications, for example Unraid)

 

docker run -d \
  --name wazuh-agent \
  --privileged \
  --network host \
  -v /var/log:/host/log:ro \
  -v /var/ossec:/var/ossec \
  -v /proc:/host/proc:ro \
  -v /sys:/host/sys:ro \
  wazuh/wazuh-agent

https://dev.to/dutdavid/wazuh-agent-as-a-docker-image-1b5n

Edited May 16, 20251 yr by Samsonight

Build & install Wazuh Agent (latest) on Unraid / Slackware (Unraid OS 7.1)

This is a clean, end-to-end guide distilled from a working build on Unraid OS 7.1 (Slackware base) with GCC 15.
It fetches the latest Wazuh release, applies the minimal fixes needed for Slackware’s toolchain, and covers enrollment gotchas.

---

What you’ll get

• A compiled and installed Wazuh agent under /var/ossec

• Agent configured to talk TCP/1514 to your Wazuh manager

• A quick path to enroll and resolve common “never connected” issues

---

Prereqs (Unraid)

1. Make sure you have the basic build toolchain:

• gcc, g++, make, cmake, curl (install via your usual Unraid method, e.g., DevPack/Un-get)

2. Install the attr headers (for attr/xattr.h):

cd /root
wget https://mirrors.slackware.com/slackware/slackware64-current/slackware64/a/attr-*.txz
installpkg attr-*.txz

3. Network: the agent must reach your manager on:

• 1514/tcp (agent <-> manager)

• 1515/tcp (enrollment via wazuh-authd)

---

Quick copy-paste: fetch latest, patch, build & install

This keeps everything simple and interactive. You’ll choose agent during the script and enter your manager hostname when asked.

# 1) Work in /root
cd /root

# 2) Pull the latest Wazuh release tarball from GitHub
LATEST=$(curl -s https://api.github.com/repos/wazuh/wazuh/releases/latest \
  | grep '"tarball_url"' | cut -d '"' -f 4)
curl -L -o wazuh-latest.tar.gz "$LATEST"

# 3) Extract and enter the source folder
tar -xzf wazuh-latest.tar.gz
cd wazuh-*/

# 4) Toolchain quirks on Slackware/GCC 15:
#    - Enforce C++17
#    - Ensure <cstdint> types are visible everywhere they’re used
export CC=gcc CXX=g++
export CXXFLAGS="$CXXFLAGS -std=gnu++17 -include cstdint"

# 5) (One-time header includes) Some headers use uint32_t/uint64_t/uint8_t
#    without including <cstdint>. Add it to the few files that need it.
sed -i '1i #include <cstdint>' \
  src/shared_modules/dbsync/src/sqlite/isqlite_wrapper.h \
  src/shared_modules/dbsync/src/sqlite/sqlite_wrapper.h \
  src/shared_modules/utils/stringHelper.h

# 6) If you rerun the installer, clean stale builds first (safe to run anytime)
rm -rf src/data_provider/build src/shared_modules/dbsync/build

# 7) Install (interactive)
./install.sh

#    - Select: agent
#    - Install dir: /var/ossec (default)
#    - Manager address: <your-manager FQDN or IP>
#    - Protocol: tcp (default)
#    - Leave other defaults unless you have a reason to change

If the build finishes, you’ll see “Done building agent” and final instructions.

---

Start the agent

/var/ossec/bin/wazuh-control start

Check the agent log:

tail -f /var/ossec/logs/ossec.log

You should see it trying to enroll, then connecting to the manager.

---

Enrollment & “never connected” fixes

1) Confirm the agent actually received a key
On the agent:

test -s /var/ossec/etc/client.keys && echo "client.keys present" || echo "NO client.keys"

• If present → the agent has enrolled.

• If missing → the agent hasn’t enrolled yet.

2) Make sure the manager is allowing enrollment
On the manager, your <auth> block (in ossec.conf) must be enabled, listening on 1515, and (if you don’t use passwords) use_password should be no. Example:

<auth>
  <disabled>no</disabled>
  <port>1515</port>
  <use_password>no</use_password>
  <purge>yes</purge>
</auth>

Restart the manager if you change this.

3) Duplicate agent name = common cause of failure
If you previously forwarded syslog or enrolled this host before, the manager may already have an entry for srv-01 (example).
Symptoms on the manager:

wazuh-authd: WARNING: Duplicate name '<name>', rejecting enrollment.

Fix on the manager (pick one):

• In the Wazuh Dashboard → Agents → delete/replace the old agent, or

• CLI: /var/ossec/bin/manage_agents → Remove the old agent with the same name.

Then, back on the agent, restart:

/var/ossec/bin/wazuh-control restart

Watch the log again:

tail -f /var/ossec/logs/ossec.log

4) If you still have no key
Enroll manually from the agent:

/var/ossec/bin/agent-auth -m <manager_fqdn_or_ip>
/var/ossec/bin/wazuh-control restart

---

Verify it’s healthy

• client.keys exists on the agent

• Agent log shows a successful connection

• In the Wazuh Dashboard, the agent status is Active

• You see inventory (syscollector), FIM (syscheck) and logs flowing in

---

Notes & rationale (why these steps)

• attr/xattr.h: Wazuh’s build and/or runtime touches extended attributes; Slackware needs the attr package installed for headers.

• GCC 15 + Slackware: Some C++ sources rely on fixed-width types without explicitly including <cstdint>. Adding the include and compiling with GNU++17 avoids compile errors like:

  • ‘uint64_t’ does not name a type

  • ‘uint8_t’ does not name a type

• Cleaning build dirs: If you tweak headers or flags and re-run, clear src/data_provider/build and src/shared_modules/dbsync/build so CMake reconfigures cleanly.

• Duplicate agent entries: The manager rejects new enrollments if an agent with the same name is still registered and not yet purged. Delete/replace it first.

---

Uninstall / re-run (optional)

If you want to nuke it and try again:

/var/ossec/bin/wazuh-control stop
rm -rf /var/ossec
# Then redo the build/install steps above.

can noone make a unraid xml template for this (and for the server)?

Could all this be packaged in a plugin for unRAID?

A plugin would be awesome!