Can we install wazuh in different location other than /var ?

[SR]

 Hi wazuh Team,

I want to change the location of ossec default installed location - /var/ossec to different location /xyz/ossec .. Is it possible to do?

I tried to symlink but it was not successful.

Thanks,

SR

[Braulio Vargas]

Hi SR,

yes it possible to install Wazuh in a different location, but for now, you need to do it installing Wazuh from sources. To do that, you need to follow these steps:

1. Download the source code from GitHub: # git clone https://github.com/wazuh/wazuh -b v3.5.0 && cd wazuh.
   
2. Compile Wazuh:
   • Manager:  # make -C src/ TARGET=server USE_SELINUX=yes PREFIX=/xyz/ossec
   • Agent:  # make -C src/ TARGET=agent USE_SELINUX=yes PREFIX=/xyz/ossec
3. Run the install.sh. The install.sh will ask you where do you want to install Wazuh. You need to type your directory:
   2- Setting up the installation environment.
   
    - Choose where to install Wazuh [/var/ossec]: /xyz/ossec
   
   

This will install Wazuh in the desired directory. The symlink option is not available, because Wazuh is compiled for a specific directory and also executes some chroots operation in this directory, that's why the symlink option is not possible.

PS: to build the latest Wazuh version, you need to install gcc, make, automake, autoconf, libtool and policycoreutils-python.

Hope it helps.

Regards,

Braulio

[SR]

Hi Braulio,

I have installed wazuh using rpm. Is it possible to install in different location using rpm? Please let me know.

Thanks,

SR

[Braulio Vargas]

Hi SR,

using the RPM packages from our repository https://packages.wazuh.com/3.x/yum, there's no way to change the installation directory for Wazuh. You need to build a new package that compiles Wazuh for your directory and use that package to install it. Currently, I'm working in this repository https://github.com/wazuh/wazuh-packages/ in two PRs: https://github.com/wazuh/wazuh-packages/pull/28 and https://github.com/wazuh/wazuh-packages/pull/27. Both PRs will add new features to the wazuh-packages repository and new tools to build .deb and .rpm packages in a very easy way and build packages for any directory.

I'm working on the last details of both PRs, so it will be merged in the master branch very soon.

Regards,

Braulio.

[Jose Luis Ruiz]

Hello All,

You can use a little trick.

Install Wazuh from packages, normally in /var/ossec, then move /var/ossec to your favourite path.

The last step is create a symbolic link from your favourite path to /var/ossec, this should works as well.

Is not my favourite option but works 

———

Jose Luis Ruiz

@jlruizmlg

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/4cfde2f9-eaea-4344-85b3-df62d69d1830%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Sayontani Bose]

Hi

I want to install the Wazuh in a specific directory instead of /var/ossec so this optional part is mandatory for it? If yes then the second command is not working for me it throws a error :

Is there any solution for that ??

Thanks & Regards

Sayontani Bose

[victor....@wazuh.com]

Hi sayontani,

An easy way to install wazuh in a different location is by using custom packages. You can find a guide for this issue in this link: https://documentation.wazuh.com/3.13/development/packaging/index.html

Note: As requirements to create the custom package you need to have installed docker and git.

First, you need to download wazuh-packages repository and place it in the corresponding directory where the package generation script is located

git clone https://github.com/wazuh/wazuh-packages && cd wazuh-packages/debs

If you want to install wazuh manager with 3.13.1 version in /xyz/ossec location use this following command:

./generate_debian_package.sh -b v3.13.1 -t manager -p /xyz/ossec

Using -b to indicate the wazuh branch version and -p to set the installation path. You can see all available parameters using -h.

After waiting for the process to finish, you will find the package in your output directory. If we install that custom package, we see how the installation directory has been set correctly.

cat /etc/ossec-init.conf

DIRECTORY="/xyz/ossec"
NAME="Wazuh"
VERSION="v3.13.1"
REVISION="31309"
DATE="Mon 31 Aug 2020 12:11:27 PM CEST"

TYPE="server"

I hope this information is helpful to you.

Regards.

[Sayontani Bose]

Hi

Thanks for your help now its solved !!

Best Regards