-1

I was surprised to find that the Wazuh server requirements state 2gb and 2 cores are the minimum requirements - but I wonder how much these numbers are tailored towards supporting multiple agents.

Is anyone running Wazuh with less than the stated minimum requirements? Specifically I'm looking to run it for a single Linux agent.

Slbox
  • 113
  • 4
  • the question might be off topic in the current point of view imho. I don't understand why you need to not accept the fact of the vendor for the minimum requirement? Almost any device has more as one cpu ready. you may use the try and error decision to make sure that your non standard setup will working – djdomi Nov 06 '22 at 10:01
  • The reason I ask is that it's not like a game or some other software where the minimum requirements are for one machine, always. The fact that the minimum requirements cover 1 to 25 agents make me think that the true minimum requirements for 1 agent could be lower, if they also are enough to support 25 agents. – Slbox Nov 06 '22 at 18:42
  • as said, try and error is in your position the only way to find out if it's working – djdomi Nov 07 '22 at 17:48
  • Asking was also a potential way to find out. Thanks. – Slbox Nov 08 '22 at 04:28

1 Answers1

1

Assuming you are also going to install the other components (Wazuh Indexer and Wazuh Dashboard), are you going to have an All In One installation? or you are having the Wazuh Server component in a different host with less than 2gb of RAM and 2 CPU cores?

If you have the Wazuh Server in a different host than the Wazuh Indexer and Wazuh Dashboard I would say it is safe to have as little as 1gb of RAM and 1 CPU for just one single Agent, you have to take into consideration the Operating System you are using too, I perform most of my tests in CentOS7 with just the minimum packages installed. About 5 months ago I was testing the Wazuh Indexer on a VM with 1GB of RAM and 1vCPU and it did not start after the installation, probably configuring the JVM options would have fixed it but increasing the RAM to 2GB made it work.

The different components require different resources as probably you notice on the documentation, for an All In One installation to monitor one single Agent I wouldn't go below 2GB of RAM and 2vCPU, in the Quickstart guide you can find the recommended values.

I was just testing with a CentOS7 machine with 1GB of RAM and 1vCPU and interestingly I could install all the components using the installation assistant, performance is not at its best but it is working, still I would recommend you to increase the resources allocated to at least 2GB and 2 cores.

[root@wazuhserver ~]# bash wazuh-install.sh -a
10/11/2022 09:51:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.9
10/11/2022 09:51:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log
10/11/2022 09:51:27 ERROR: Your system does not meet the recommended minimum hardware requirements of 4Gb of RAM and 2 CPU cores. If you want to proceed with the installation use the -i option to ignore these requirements.
[root@wazuhserver ~]# bash wazuh-install.sh -a -i
10/11/2022 09:53:47 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.9
10/11/2022 09:53:47 INFO: Verbose logging redirected to /var/log/wazuh-install.log
10/11/2022 09:53:50 WARNING: Hardware and system checks ignored.
10/11/2022 09:53:53 INFO: Wazuh repository added.
10/11/2022 09:53:53 INFO: --- Configuration files ---
10/11/2022 09:53:53 INFO: Generating configuration files.
10/11/2022 09:53:54 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
10/11/2022 09:53:54 INFO: --- Wazuh indexer ---
10/11/2022 09:53:54 INFO: Starting Wazuh indexer installation.
10/11/2022 09:55:13 INFO: Wazuh indexer installation finished.
10/11/2022 09:55:13 INFO: Wazuh indexer post-install configuration finished.
10/11/2022 09:55:13 INFO: Starting service wazuh-indexer.
10/11/2022 09:55:46 INFO: wazuh-indexer service started.
10/11/2022 09:55:46 INFO: Initializing Wazuh indexer cluster security settings.
10/11/2022 09:56:08 INFO: Wazuh indexer cluster initialized.
10/11/2022 09:56:08 INFO: --- Wazuh server ---
10/11/2022 09:56:08 INFO: Starting the Wazuh manager installation.
10/11/2022 09:57:16 INFO: Wazuh manager installation finished.
10/11/2022 09:57:16 INFO: Starting service wazuh-manager.
10/11/2022 09:57:37 INFO: wazuh-manager service started.
10/11/2022 09:57:37 INFO: Starting Filebeat installation.
10/11/2022 09:58:25 INFO: Filebeat installation finished.
10/11/2022 09:58:26 INFO: Filebeat post-install configuration finished.
10/11/2022 09:58:27 INFO: Starting service filebeat.
10/11/2022 09:58:27 INFO: filebeat service started.
10/11/2022 09:58:27 INFO: --- Wazuh dashboard ---
10/11/2022 09:58:27 INFO: Starting Wazuh dashboard installation.
10/11/2022 10:00:17 INFO: Wazuh dashboard installation finished.
10/11/2022 10:00:17 INFO: Wazuh dashboard post-install configuration finished.
10/11/2022 10:00:17 INFO: Starting service wazuh-dashboard.
10/11/2022 10:00:17 INFO: wazuh-dashboard service started.
10/11/2022 10:01:40 INFO: Initializing Wazuh dashboard web application.
10/11/2022 10:01:42 INFO: Wazuh dashboard web application initialized.
10/11/2022 10:01:42 INFO: --- Summary ---
10/11/2022 10:01:42 INFO: You can access the web interface https://<wazuh-dashboard-ip>
    User: admin
    Password: RlT.Fmrk2zvBgSUcHXXwb0?4YeK2t6aU
10/11/2022 10:01:42 INFO: Installation finished.

Page: Management > Status enter image description here

Page: Modules > Security Events enter image description here

C. Dams
  • 31
  • 4