Wazuh 4.3 using a lot of memory

[Chris German]

Hey All,

I just installed Wazuh 4.3 in LXC Container for testing using Ubuntu 20.04 LTS. After doing "wazuh-install.sh -a" I notice my host memory went from 19-20GB to 71GB.

I have two agents on there, and this is what I see on the container when I run "ps aux | awk '{print $6/1024 " MB\t\t" $11}' | sort -n"

What I was wondering, is this normal? In wazuh 4.2 manual install, it wasn't taking this much memory up.  

[Alberto Rodriguez]

Hello

  It could be normal because the Wazuh installation assistant (wazuh-install.sh) automatically assigns to the Wazuh indexer java heap memory process the half of a "free -m" total available memory. If you have 72GB ram, the `/etc/wazuh-indexer/jvm.options` has been configured to 36GB, as Elasticsearch documentation recommends. You can change this value to your desired heap memory value using the settings Xms and Xmx. Could you please check and confirm?

Thanks

[Chris German]

Thanks for the fast reply Alberto! 

Looking at the jvm.options I do see this:

I changed the values to "10g" for testing, then rebooted the container. Now I'm seeing it using less memory! 

Thank you! :)