Installing the Wazuh agent from sources

60 views

Skip to first unread message

Burak Bellioğlu

unread,

Jul 30, 2024, 2:12:36 AM7/30/24

to Wazuh | Mailing List

Install.sh ask me "You already have Wazuh installed. Do you want to update it? (y/n)" and i update then it closes. İt does not ask me set the installation mode and Choose where to install Wazuh Agent. Why is that? Do I have to remove the wazuh?

Rafael Bailon Robles

unread,

Jul 30, 2024, 3:05:59 AM7/30/24

to Wazuh | Mailing List

Hi! I have investigated your case. I have tried to reproduce the error locally but, in my case, I have not received any error or had any problems. I have followed the steps that you can find in the official documentation Installing the Wazuh agent from sources Once the ./install.sh script has finished its task, I have run it again, without doing anything else and it has worked correctly. Here are the logs that I have obtained when doing the update.

Done building agent Stopping Wazuh... agent Wait for success... success Removing old SCA policies... Installing SCA policies... Wait for success... success Starting Wazuh... - Configuration finished properly. - To start Wazuh: /var/ossec/bin/wazuh-control start - To stop Wazuh: /var/ossec/bin/wazuh-control stop - The configuration can be viewed or modified at /var/ossec/etc/ossec.conf Thanks for using Wazuh. Please don't hesitate to contact us if you need help or find any bugs. Use our public Mailing List at: https://groups.google.com/forum/#!forum/wazuh More information can be found at: - http://www.wazuh.com --- Press ENTER to finish (maybe more information below). --- - Update completed.

Also note that when doing an upgrade, the script does not request the same parameters again as when doing a clean installation.

You are about to start the installation process of Wazuh. You must have a C compiler pre-installed in your system. - System: Linux debian12.localdomain 6.1.0-17-amd64 (debian 12.0) - User: root - Host: debian12.localdomain -- Press ENTER to continue or Ctrl-C to abort. -- - You already have Wazuh installed. Do you want to update it? (y/n): y - Installation will be made at /var/ossec .

Have you verified that your Wazuh Agent installation is correct? You can check some things with the following commands:

Agent Version: /var/ossec/bin/wazuh-control info
Agent Status: systemctl status wazuh-agent -l
Module Status: /var/ossec/bin/wazuh-control status
Service Status: journalctl -xe -u wazuh-agent.service
Error Logs: egrep -i "ERROR|WARNING" /var/ossec/logs/ossec.log

With these commands you can check if there is any error in the Wazuh Agent and that is why the upgrade is not being done correctly.

You can also try to clean the build and redo the steps to generate a new build. You have the steps in the documentation. And another solution could be to uninstall the Agent and reinstall it.