multiple Wazuh agents on the same virtual machine

[rached cherif]

i have ubuntu vm. I want to already installed  an agent and it works fine but i try to install another agent i don't get any error , but the vm i don't see it in dashboard of wazuh ,
 any solution ?

[Julio Gasco]

Hi Rached,

I hope you are doing fine.

Could you explain further your use case ?

If you mean installing on a new VM the wazuh agent, once you install the agent and configure it to point to the wazuh manager using the following procedure:

https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html

You can then after starting the agent see the log in /var/ossec/logs/ossec.log to detect any issues that might be going on with connection or registering of the agent. Please share this file if this is the case so I can help you further troubleshooting your issue.

If you mean installing an agent on a VM which has the agent already installed, this is not supported, but I don´t understand the use case for this.

Please clarify this so we can get this working.

Regards!

[Julio Gasco]

Hi Rached,

Sorry for the delay, as you answered directly I missed your reply, I will reply all to it is a reference for other users.

Taking a look at the ossec.log you sent from the agent you are receiving the following errors:

2023/02/25 09:14:13 wazuh-agentd: INFO: No authentication password provided 2023/02/25 09:14:13 wazuh-agentd: INFO: Using agent name as: kali 2023/02/25 09:14:13 wazuh-agentd: INFO: Waiting for server reply 2023/02/25 09:14:14 wazuh-agentd: ERROR: Invalid passwordERROR: Unable to add agent (from manager)
This means that the manager has a password configured for agents registration and you need to update the agent configuration to use that password
In the following documentation you have some information on this issue:https://documentation.wazuh.com/current/user-manual/agent-enrollment/troubleshooting.html#invalid-password

You need to follow the next steps:
1. Check the authd.pass exists on the agent and has the same passwor on the one you have configured on the manager    - To check the password you have configured run:        cat /var/ossec/etc/authd.pass   - To check if the file exists on you agent do:       cat /var/ossec/etc/authd.pass   - If the file exists make sure it has the same content as the one in the manager.   - If the file does not exists create the file /var/ossec/etc/authd.pass on your agent and put the password you have on the manager file. then change owner and permissions using the following commands:         chmod 640 /var/ossec/etc/authd.pass         chown root:wazuh /var/ossec/etc/authd.pass

Finally restart your agent running: systemctl restart wazuh-manager

With this you agent should register with your wazuh-manager.

Please let me know if this helps, don´t forget to reply all so any other query shows in the group for future reference.

Regards!