Agentless configuration | Logs issue

58 views
Skip to first unread message

Ramkumar R

unread,
Apr 17, 2025, 12:15:01 PM4/17/25
to Wazuh | Mailing List
Hi Team,

As per the documentation, I have set up the server and configured the agentless setup. However, I am not seeing any logs from the agentless configuration.

Currently, I have provided my server IP in the agentless configuration. Could you please confirm whether this should be the server IP or the client IP?

Kindly review the confirmation below and share your feedback. Let me know if anything is missing or if any additional services (such as SSH configuration) are required.

I've attached the configuration files for your reference.


<!--

  Wazuh - Manager - Default configuration for ubuntu 24.04

  More info at: https://documentation.wazuh.com

  Mailing list: https://groups.google.com/forum/#!forum/wazuh

-->

 

<ossec_config>

  <global>

    <jsonout_output>yes</jsonout_output>

    <alerts_log>yes</alerts_log>

    <logall>no</logall>

    <logall_json>no</logall_json>

    <email_notification>no</email_notification>

    <smtp_server>smtp.example.wazuh.com</smtp_server>

    <email_from>wa...@example.wazuh.com</email_from>

    <email_to>reci...@example.wazuh.com</email_to>

    <email_maxperhour>12</email_maxperhour>

    <email_log_source>alerts.log</email_log_source>

    <agents_disconnection_time>10m</agents_disconnection_time>

    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>

    <update_check>yes</update_check>

  </global>

 

<agentless>

  <type>ssh_integrity_check_linux</type>

  <frequency>60</frequency>

  <host>ro...@192.168.125.135</host> 

  <state>periodic</state>

  <arguments>/bin /etc /sbin /var</arguments>

</agentless>

 

  <alerts>

    <log_alert_level>3</log_alert_level>

    <email_alert_level>12</email_alert_level>

  </alerts>

 

  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->

  <logging>

    <log_format>plain</log_format>

  </logging>

 

  <remote>

    <connection>secure</connection>

    <port>1514</port>

    <protocol>tcp</protocol>

    <queue_size>131072</queue_size>

  </remote>

 

  <!-- Policy monitoring -->

  <rootcheck>

    <disabled>no</disabled>

    <check_files>yes</check_files>

    <check_trojans>yes</check_trojans>

    <check_dev>yes</check_dev>

    <check_sys>yes</check_sys>

    <check_pids>yes</check_pids>

    <check_ports>yes</check_ports>

    <check_if>yes</check_if>

 

    <!-- Frequency that rootcheck is executed - every 12 hours -->

    <frequency>43200</frequency>

 

    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>

    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

 

    <skip_nfs>yes</skip_nfs>

 

    <ignore>/var/lib/containerd</ignore>

    <ignore>/var/lib/docker/overlay2</ignore>

  </rootcheck>

 

  <wodle name="cis-cat">

    <disabled>yes</disabled>

    <timeout>1800</timeout>

    <interval>1d</interval>

    <scan-on-start>yes</scan-on-start>

 

    <java_path>wodles/java</java_path>

    <ciscat_path>wodles/ciscat</ciscat_path>

  </wodle>

 

  <!-- Osquery integration -->

  <wodle name="osquery">

    <disabled>yes</disabled>

    <run_daemon>yes</run_daemon>

    <log_path>/var/log/osquery/osqueryd.results.log</log_path>

    <config_path>/etc/osquery/osquery.conf</config_path>

    <add_labels>yes</add_labels>

  </wodle>

 

  <!-- System inventory -->

  <wodle name="syscollector">

    <disabled>no</disabled>

    <interval>1h</interval>

    <scan_on_start>yes</scan_on_start>

    <hardware>yes</hardware>

    <os>yes</os>

    <network>yes</network>

    <packages>yes</packages>

    <ports all="no">yes</ports>

    <processes>yes</processes>

 

    <!-- Database synchronization settings -->

    <synchronization>

      <max_eps>10</max_eps>

    </synchronization>

  </wodle>

 

  <sca>

    <enabled>yes</enabled>

    <scan_on_start>yes</scan_on_start>

    <interval>12h</interval>

    <skip_nfs>yes</skip_nfs>

  </sca>

 

  <vulnerability-detection>

    <enabled>yes</enabled>

    <index-status>yes</index-status>

    <feed-update-interval>60m</feed-update-interval>

  </vulnerability-detection>

 

  <indexer>

    <enabled>yes</enabled>

    <hosts>

      <host>https://127.0.0.1:9200</host>

    </hosts>

    <ssl>

      <certificate_authorities>

        <ca>/etc/filebeat/certs/root-ca.pem</ca>

      </certificate_authorities>

      <certificate>/etc/filebeat/certs/wazuh-server.pem</certificate>

      <key>/etc/filebeat/certs/wazuh-server-key.pem</key>

    </ssl>

  </indexer>

 

  <!-- File integrity monitoring -->

  <syscheck>

    <disabled>no</disabled>

 

    <!-- Frequency that syscheck is executed default every 12 hours -->

    <frequency>43200</frequency>

 

    <scan_on_start>yes</scan_on_start>

 

    <!-- Generate alert when new file detected -->

    <alert_new_files>yes</alert_new_files>

 

    <!-- Don't ignore files that change more than 'frequency' times -->

    <auto_ignore frequency="10" timeframe="3600">no</auto_ignore>

 

    <!-- Directories to check  (perform all possible verifications) -->

    <directories>/etc,/usr/bin,/usr/sbin</directories>

    <directories>/bin,/sbin,/boot</directories>

 

    <!-- Files/directories to ignore -->

    <ignore>/etc/mtab</ignore>

    <ignore>/etc/hosts.deny</ignore>

    <ignore>/etc/mail/statistics</ignore>

    <ignore>/etc/random-seed</ignore>

    <ignore>/etc/random.seed</ignore>

    <ignore>/etc/adjtime</ignore>

    <ignore>/etc/httpd/logs</ignore>

    <ignore>/etc/utmpx</ignore>

    <ignore>/etc/wtmpx</ignore>

    <ignore>/etc/cups/certs</ignore>

    <ignore>/etc/dumpdates</ignore>

    <ignore>/etc/svc/volatile</ignore>

 

    <!-- File types to ignore -->

    <ignore type="sregex">.log$|.swp$</ignore>

 

    <!-- Check the file, but never compute the diff -->

    <nodiff>/etc/ssl/private.key</nodiff>

 

    <skip_nfs>yes</skip_nfs>

    <skip_dev>yes</skip_dev>

    <skip_proc>yes</skip_proc>

    <skip_sys>yes</skip_sys>

 

    <!-- Nice value for Syscheck process -->

    <process_priority>10</process_priority>

 

    <!-- Maximum output throughput -->

    <max_eps>50</max_eps>

 

    <!-- Database synchronization settings -->

    <synchronization>

      <enabled>yes</enabled>

      <interval>5m</interval>

      <max_eps>10</max_eps>

    </synchronization>

  </syscheck>

 

  <!-- Active response -->

  <global>

    <white_list>127.0.0.1</white_list>

    <white_list>^localhost.localdomain$</white_list>

    <white_list>127.0.0.53</white_list>

  </global>

 

  <command>

    <name>disable-account</name>

    <executable>disable-account</executable>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <command>

    <name>restart-wazuh</name>

    <executable>restart-wazuh</executable>

  </command>

 

  <command>

    <name>firewall-drop</name>

    <executable>firewall-drop</executable>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <command>

    <name>host-deny</name>

    <executable>host-deny</executable>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <command>

    <name>route-null</name>

    <executable>route-null</executable>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <command>

    <name>win_route-null</name>

    <executable>route-null.exe</executable>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <command>

    <name>netsh</name>

    <executable>netsh.exe</executable>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <!--

  <active-response>

    active-response options here

  </active-response>

  -->

 

  <!-- Log analysis -->

  <localfile>

    <log_format>command</log_format>

    <command>df -P</command>

    <frequency>360</frequency>

  </localfile>

 

  <localfile>

    <log_format>full_command</log_format>

    <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>

    <alias>netstat listening ports</alias>

    <frequency>360</frequency>

  </localfile>

 

  <localfile>

    <log_format>full_command</log_format>

    <command>last -n 20</command>

    <frequency>360</frequency>

  </localfile>

 

  <ruleset>

    <!-- Default ruleset -->

    <decoder_dir>ruleset/decoders</decoder_dir>

    <rule_dir>ruleset/rules</rule_dir>

    <rule_exclude>0215-policy_rules.xml</rule_exclude>

    <list>etc/lists/audit-keys</list>

    <list>etc/lists/amazon/aws-eventnames</list>

    <list>etc/lists/security-eventchannel</list>

 

    <!-- User-defined ruleset -->

    <decoder_dir>etc/decoders</decoder_dir>

    <rule_dir>etc/rules</rule_dir>

  </ruleset>

 

  <rule_test>

    <enabled>yes</enabled>

    <threads>1</threads>

    <max_sessions>64</max_sessions>

    <session_timeout>15m</session_timeout>

  </rule_test>

 

  <!-- Configuration for wazuh-authd -->

  <auth>

    <disabled>no</disabled>

    <port>1515</port>

    <use_source_ip>no</use_source_ip>

    <purge>yes</purge>

    <use_password>no</use_password>

    <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>

    <!-- <ssl_agent_ca></ssl_agent_ca> -->

    <ssl_verify_host>no</ssl_verify_host>

    <ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>

    <ssl_manager_key>etc/sslmanager.key</ssl_manager_key>

    <ssl_auto_negotiate>no</ssl_auto_negotiate>

  </auth>

 

  <cluster>

    <name>wazuh</name>

    <node_name>node01</node_name>

    <node_type>master</node_type>

    <key></key>

    <port>1516</port>

    <bind_addr>0.0.0.0</bind_addr>

    <nodes>

        <node>NODE_IP</node>

    </nodes>

    <hidden>no</hidden>

    <disabled>yes</disabled>

  </cluster>

 

</ossec_config>

 

<ossec_config>

  <localfile>

    <log_format>journald</log_format>

    <location>journald</location>

  </localfile>

 

  <localfile>

    <log_format>syslog</log_format>

    <location>/var/ossec/logs/active-responses.log</location>

  </localfile>

 

  <localfile>

    <log_format>syslog</log_format>

    <location>/var/log/dpkg.log</location>

  </localfile>

 

</ossec_config>


Thanks
Ramkumar R 

Ramkumar R

unread,
Apr 20, 2025, 11:24:05 PM4/20/25
to Wazuh | Mailing List
Hi Team,

Any update on this?

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/4890391d-d4d8-4fbd-ab60-34ad75f4f9b0n%40googlegroups.com.


--

Thanks & Regards,
Ramkumar.R

hasitha.u...@wazuh.com

unread,
Apr 21, 2025, 12:10:35 AM4/21/25
to Wazuh | Mailing List
Hi Ramkumar,

As stated in the document, you should use the username along with the IP address or hostname of the agentless device.
host  | Any username and host (username@hostname)  |  Defines the username and the hostname or IP address of the agentless endpoint.
Ref: https://documentation.wazuh.com/current/user-manual/capabilities/agentless-monitoring/agentless-configuration.html#supported-attributes

<agentless>

  <type>ssh_integrity_check_linux</type>

  <frequency>60</frequency>

  <host>username@IPorHostname</host> 

  <state>periodic</state>

  <arguments>/bin /etc /sbin /var</arguments>

</agentless>


Try replacing the username with agentless endpoint username and replace this part  IPorHostname with agentless device IP or hostname.

After that, restart the Wazuh manager to apply changes.
systemctl restart wazuh-manager

Further, you can refer to the above-mentioned guide to have supported attributes.

Let me know the update on this.

Regards,
Hasitha Upekshitha
Reply all
Reply to author
Forward
0 new messages