Determining Cluster Size for 500 Agents

[Yazid Rabah]

Hi Wazuh team ,

I have 500 agents running on both Linux and Windows systems. I already have a Wazuh manager indexer and a dashboard : 

wazuh server : 4GB RAM , 8 CPUs

wazuh indexer : 8GB RAM , 16 CPUs

wazuh dashboard : 8GB RAM, 4 CPUs

How many nodes do I need for the Wazuh manager and the indexer , or this is enough ?

and please explain me how did you calculated it or  provide a reference that would help me understand how to determine the appropriate size?

because i need to justify why I require an additional worker node in case .

Thank you 

[Jeremiah Kolawole]

Hello Yazid,

The minimum hardware for a wazuh-server is 2GB of RAM and 2vCPU and It is recommended to use at least 4GB RAM with 8 CPU cores.
You can find more information here in the documentation

Your current deployment meets these minimum hardware requirements but to manage up to 500 agents with a single node deployment, I'll recommend using at least 16 CPU cores and 32 GB RAM. There is no limit to the vertical scaling for this requirement. However, it is recommended to use multi-node deployment for load balancing.

You should also know that the specifications are not fixed and are in fact dependent on many factors such as the amount of data generated by the agents, the integrations, the network bandwidth. Therefore, in general terms, a server with higher RAM and CPU resources can handle more agents.

I hope this helps.