Minimum Requirement For Wazuh Server

[Haziq Mt Roslan]

Hi Team,

I have question regarding to minimum requirement for installing Wazuh Server. Say, I have one server and 50 host that connected to it. Roughly, what is the minimum of RAM, CPU and storage that I need for the server.

Second question, for 50 endpoints do I recommended to use leaky bucket algorithm and Clustering even though (I'm sure the server will not shut down).

Thanks in advance.

[victor....@wazuh.com]

Hello Haziq,

To effectively run Wazuh, it is recommended to meet certain system requirements. The minimum requirements include 2GB of RAM and 2 CPU cores. However, for optimal performance, it is recommended to have at least 4GB of RAM and 8 CPU cores.

When it comes to disk space, the amount of data generated depends on the number of alerts generated per second. For more detailed information on hardware requirements, you can refer to the documentation page available here. Additionally, please note that each workstation typically requires around 2GB of disk space every 90 days.

To determine if these requirements align with your specific use case and if your manager requires additional resources, you can monitor the following files:

- /var/ossec/var/run/wazuh-analysisd.state: The 'events_dropped' variable indicates whether events are being dropped due to resource limitations.
- /var/ossec/var/run/wazuh-remoted.state: The 'discarded_count' variable indicates if messages from the agents were discarded.

Ideally, these two variables should be zero, indicating that the environment is functioning properly. If they are not, it may be necessary to consider implementing clustering in your environment. Additionally, if your use case involves a high availability requirement, it is also highly recommended to create a cluster with additional nodes.

Feel free to let me know if you have any doubts or questions.