How to reregister agent using bash script

219 views
Skip to first unread message

kumar shubham

unread,
Nov 23, 2022, 7:02:05 AM11/23/22
to Wazuh mailing list
Dear Team,

I am facing challenge while find the bash script. 

let me explain you the scenario

currently we have 2 wazuh environment and we are migrating from older one to new one all the datasource has been migrate successfully but i am looking for bash script which can be use for changing the wazuh manger ip in wazuh agent ossec.conf file and add the certificate. if any one has it handy it would be quite appreciated.

Regards,
Kumar Shubham 

Jeremias Ignacio Posse

unread,
Nov 23, 2022, 7:55:16 AM11/23/22
to Wazuh mailing list
Hello friend I hope you are well to perform the migration of the agents and all the configurations you can follow this guide of our documentation, but maybe you have already seen it?

https://documentation.wazuh.com/current/migration-guide/migrating-from-ossec/ossec-agent.html

Also, I leave you other guides that may be helpful

https://wazuh.slack.com/archives/C0A933R8E/p1664726593560789

https://groups.google.com/g/wazuh/c/YWpR-vNHl0E

Let me know if I can help you with any other questions, thanks for using Wazuh!
Greetings!

Juan Carlos Tello

unread,
Nov 23, 2022, 9:32:28 AM11/23/22
to Jeremias Ignacio Posse, Wazuh mailing list
Hi Kumar,

Since you're looking to automate the re-configuration and re-registration process (and the manager has already been created) I believe you're looking for something like this:

#!/bin/bash

newip=192.168.43.2

sed -ir "s#<address>.*</address>#<address>$newip</address>#g" /var/ossec/etc/ossec.conf

/var/ossec/bin/agent-auth -m $newip

systemctl restart wazuh-agent


This assumes you're only using the <global><address> stanza to specify where your agents need to connect to. If your agents also have an <enrollment> section configured then be sure add another sed command to modify the <manager_address> configuration.

Let us know if you have any other questions.
Best regards,
Juan C. Tello



--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/5a8c1ef2-676f-4ebd-84e0-040380bdd6d2n%40googlegroups.com.
Reply all
Reply to author
Forward
0 new messages