Change agent ip and manager

[vijay kumar]

Please guide me who to change agent ip as well manager in wazuh

[Do Tuan]

Hi,

Can you please confirm that I have understood your question correctly: you want to change the IP address of the agent on the manager side after the registration process?
In case I got it right please follow these steps:
- Stop the manager. To do this, for example, in the CentOS you will need to run this command: systemctl stop wazuh-manager
- In the manager and agent machines please modify the file /var/ossec/etc/client.keys. There will be four values separated by spaces, and the third value is the IP that you will need to change. On the manager side you will have the list of agents that are registered to this manager, please change the ip value of the agent that you need.
- Rename the name of the file /var/ossec/queue/agent-info/<your-agent-name>-<your-agent-ip> to /var/ossec/queue/agent-info/<your-agent-name>-<your-agent-new-ip>
- Rename the name of the file /var/ossec/queue/rootcheck/<your-agent-name>-<your-agent-ip> to /var/ossec/queue/rootcheck/<your-agent-name>-<your-agent-new-ip>
- Then, restart both your agent and your manager.


Kind regards,
Do Tuan Anh.

[vijay kumar]

My question is i want to change ip of agent that is install on my laptop and i want to change ip of manager that is installed on pc.

Second i want that i ask that 

Rename the name of the file /var/ossec/queue/agent-info/<your-agent-name>-<your-agent-ip> to /var/ossec/queue/agent-info/<your-agent-name>-<your-agent-new-ip>

 

Or to change the content of this file

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/5d4f87ab-ce83-452e-aa36-56deca89c606n%40googlegroups.com.

[vijay kumar]

Hi Do Tuan Anh, i try that you said how to change ip of manager and agent . After changing it work fine for 10 -15 min only .during this period got all alert of my agent whose ip change recently .but after 15 min i see that it automatically delete /var/ossec/queue/agent-info/<your-agent-name>-<your-agent-ip> and /var/ossec/queue/rootcheck/<your-agent-name>-<your-agent-ip>

now no data shown of my agent in manager and also the file /var/ossec/etc/client.keys contain all data of my agent.

The same thing happen for my another agent as well .so please guide me how can i recover these agent.

[Do Tuan]

Hi,

Regarding your first question: you need to change the name of the files, not the contents.
Can you check the status of your agents with a command: /var/ossec/bin/agent_control -l
You can reconnect your agent to your manager following the next steps:
- From the manager machine please run: /var/ossec/bin/manage_agents -e <your-agent-id> . Save this Agent key information
- From the manager agent please run: /var/ossec/bin/manage_agents -i <the-agent-key-information>
- In the agent machine: check if the <address> tag in the file /var/ossec/etc/ossec.conf  has the manager's ip address.
- Restart your wazuh-agent

Kind regards,
Do Tuan Anh.