2

I have two questions. My Immediate problem is WAZUH-AGENT never connects to WAZUH-MANAGER

A. That makes me think, While installing Wazuh Manager, where do we provide WAZUH MANAGER IP?

B. I registered Windows and RHEL machines as agents but none of them are able to connect - all agents are NEVER CONNECTED status.

From windows , it is the error . I am using port#1515 and TCP

ERROR: (1216): Unable to connect to 'xx.xxx.105.75': 'A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.'

I even tried changing 1515 to 1519 from Kibana-Wazuh app. And added my Agent IP in white-list, not sure if that matters.

MGP
  • 2,981
  • 35
  • 34
Subhajit Pathak
  • 31
  • 1
  • 1
  • 4

3 Answers3

7

Answering your questions according to the current version of wazuh v3.13.1 as of today:

[A] While installing Wazuh Manager, where do we provide WAZUH MANAGER IP?

In the installation of the manager you don't have to configure any IP unless you are configuring the cluster mode. WAZUH MANAGER IP is necessary to configure it in the agents.

After installing the agent, you have to:

  • Add the manager's ip address in the configuration file /var/ossec/etc/ossec.conf

    <address>MANAGER_IP</address>

  • Register the agent in the manager. The simplest method is

    /var/ossec/bin/agent-auth -m MANAGER_IP

  • Restart the wazuh agent

    systemctl restart wazuh-agent

Once these steps are applied, you should have your agent connected and reporting to the manager.

[B] I registered Windows and RHEL machines as agents but none of them are able to connect - all agents are NEVER CONNECTED status.

After having performed the steps mentioned above, you should have connection of the agents with the manager. If not, then a troubleshooting process must be followed.

  • Check that the agent has successfully registered in the manager. You can use the command /var/ossec/bin/agent_control -l and see if the manager has the agent registered.

  • Check that you have a connection to the manager from the agents.

  • Wazuh uses by default ports 1515/TCP for registration and 1514/UDP for communication. Check that you have a connection through these ports (check firewall rules ...)

  • To avoid possible problems, check that your manager's version is >= that the agent's version.

  • Check if there has been an error in /var/ossec/logs/ossec.log file.

I hope this information is helpful to you.

Best regards.

Jonathan Martín
  • 71
  • 1
  • 3
0

A.You will have to edit ossec.conf file and make sure you have the MANAGER_IP address put it right place.

B.After you complete the section A. and if 1514/1515 ports are opened, you will be seeing your agent on the manager. Do not forget to register your aget to the manager.

stoksoz
  • 15
  • 3
0

I Think there have two steps: 1.To edit ossec.conf in agent. to change the 'MANAGER_IP' to real manager IP. This is very import and it's very easy to forget to edit it. 2.Restart the Agent.

吴小葱
  • 3
  • 3