how to edit files in a wazuh docker container

[Brad Nelson]

Hi All,

im new to docker and wazuh. I need to edit the ossec.conf on the wazuh server to enable Syslog. Im running docker and i believe i have to do a command like: Docker exec

I tried:
"docker exec -it CONTAINER_ID sh"

and was able to get into some type of shell but was not able to find the

/var/ossec folder.

Thanks for any clarification you could provide.

[Hossam El Amraoui]

Hello Brad Nelson,

If you're trying to modify the ossec.conf file, you can do so from the Wazuh Dashboard. You can achieve this by going to Wazuh > Server management > Settings, and click on 'Edit configuration' button:

Once here, you can modify the settings that you need.

Consider that this file is linked to a system volume, so the changes will persist after the container restarts. You can check this in the docker-compose.yml file:

    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
      - filebeat_etc:/etc/filebeat
      - filebeat_var:/var/lib/filebeat
      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

As an alternative, you can edit the file directly from the volume, and then restart the container:

`docker exec -it <manager_container_id> /bin/bash`
`nano /var/ossec/etc/ossec.conf`

And then, restart the container by running the following command:

`docker restart <container_id>`

However, I'd recommend using the Wazuh-Dashboard to manage this file since it's easier. You can also apply the configurations by restarting the Wazuh Manager from here, and you don't need to use Docker CLI.
Let me share with you some official documentation related to this topic:

- https://documentation.wazuh.com/current/deployment-options/docker/wazuh-container.html

I hope this helps.
Regards!