Re: Lab Wazuh Server all-in-one on Raspberry Pi 4 with 8gb ? Install tips

[Dario Menten]

Hello Lasse,

Thank you for posting in community.

In that case, you will need to install the Wazuh Manager from sources: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-server/index.html

Then you can replace Wazuh Indexer and Wazuh Dashboard with OpenSearch and OpenSearch dashboards but you will not be able to manage the agents from the UI since that is only in Wazuh Dashboard. But you can index all the alerts and query them from the OpenSearch Dashboards.

To download the OpenSearch packages for the architecture you need please check the downloads from OpenSearch: https://opensearch.org/downloads.html

Please let me know if you have any further question.

On Wednesday, April 12, 2023 at 7:13:15 PM UTC-3 Lasse Kim Christiansen wrote:

I have not really been able to find a decent writeup on how to install a full All-in-one Wazuh manager with indexer and dashboards on a Raspberry pi 4 (or ARM64 platform in general).

Wazuh-indexer and Wazuh-dashboards do not have arm64 versions. Could these be almost replaced with a drop in of opensearch and opensearch-dashboard since these do have arm64 version ?

Or have anyone got any pointers ? The form factor of a raspberry pi 4 makes it perfect and easy for trying things out ? Especially form ARM platforms.

[Dario Menten]

Hello Lasse,

I hope you are fine, unfortunately, that's the only issue, the Wazuh App plugin is not present for ARM64 architecture. But you can install the Wazuh Manager on it, and the Wazuh Dashboard/Indexer in another box, if that is an option.

Even you can evaluate to run the complete solution on Docker: https://documentation.wazuh.com/current/deployment-options/docker/index.html

Since you can run Docker on ARM64: https://www.simplilearn.com/tutorials/docker-tutorial/raspberry-pi-docker

I hope this could be useful for you.

On Monday, April 17, 2023 at 2:40:47 PM UTC-3 Lasse Kim Christiansen wrote:

Thanks for the feedback. 

Install from source would not be a problem. But not being able to manage the agents from the UI is kind of a deal-breaker (actually a big surprise. did not know that agent management would work through opensearch dashboards). So currently there is apparent no solution to get Wazuh completely running on an ARM64 platform. Such as Mac, Alma/Rocky/CentOS on ARM64, Raspberry or lots, and lots of cloud ARM platforms.

Big shame. 

Well then the Raspberry Pi's will have to be repurposed to another job.