Maximum number of agents in a node

[Isaac S.]

Hello Wazuh Team

Based in the wazuh documentation, I am trying to guess what could be the maximum number of endpoints agents that is possible integrate to a server with 18cpu and 20GB ram.

- The table in https://documentation.wazuh.com/current/quickstart.html#hardware , is a estimate but with servers , enpoints or both ?

- The requirements are for the number of agents or the quantity of alerts that could be generated ?

The wazuh all-in-one is in version 4.14.5

TY

Isaac

[Md. Nazmur Sakib]

A single Wazuh manager can handle 14,000 agents. The number of agents your manager can handle depends on the number of alerts generated by your endpoints or agents. So how many agents 18cpu and 20 GB RAM can handle will depend on the events your endpoints are generating.  

To properly size a big environment, we should consider the following:

• EPS the environment will receive. This will affect the number of nodes and the hardware specifications for it.

• Retention policy for the data. This will affect the disk space of the servers and the shard configuration for the Wazuh Indexer (EPS will also affect the shard configuration).

Wazuh does not limit the number of EPS per Wazuh server node, and the number of nodes in your architecture will depend on the hardware of the server. For that reason, we recommend first setting up a testing environment to measure the number of EPS of a set of your endpoints. With this information, it is possible to scale the total requirements of the production environment.

To determine if a Wazuh server requires more resources, monitor these files:

/var/ossec/var/run/wazuh-analysisd.state: the variable events_dropped indicates whether events are being dropped due to a lack of resources.

/var/ossec/var/run/wazuh-remoted.state: the variable discarded_count indicates if messages from the agents were discarded.

Reference: https://documentation.wazuh.com/current/user-manual/reference/statistics-files/index.html

As a general rule, for big environments, Wazuh server nodes can work with 8 CPU cores and 16 GB of RAM. Wazuh Indexer nodes can work with 16 CPU cores and 32 GB of RAM. For big environments, it is recommended to have a distributed deployment instead of all-in-one to properly measure how much resources each component is consuming and scale specific servers based on that.

Additionally, as Wazuh easily scales horizontally rather than vertically, we recommend adding a new node when you see drops in the events (taking into consideration the hardware specifications mentioned above). Your testing environment can be easily converted into a production environment because of this. Adding new Wazuh server nodes
Adding new Wazuh indexer nodes

So I suggest you keep an eye on the performance of your Wazuh server and the stats files and add a new node if you face any performance issues or event drops.

[Isaac S.]

Hello Nazmur

Thank you for your response. I understand then that it is important to check the EPS. I will consider that.

Isaac