Wazuh Agent ID Back to 001

[Yogi Valentino]

I was using Wazuh and Adding agent tester, then i removed it. When I put new agent it's continued give a new number. How do i make a new agent back to ID 001?

[Hossam El Amraoui]

This process could be a bit tricky and probably is preferable to keep the new agent IDs. Anyway, if you want to maintain the ID 001, you should follow the following steps:

1. Install the wazuh agent, but don't initialize it. For example:
```
# WAZUH_MANAGER='192.168.56.90' dpkg -i ./wazuh-agent_4.14.2-1_amd64.deb
```

2. Stop the wazuh-manager and generate a key:
```
# systemctl stop wazuh-manager
# openssl rand -hex 32
513171b65a9c77db96c35810983ced3e7d0878765dbca8adf9f24c4a630498f3
```

3. Remove the 001 entry if it exists from /var/ossec/etc/client.keys and add the new agent with the key:
```
# echo '001 test 192.168.56.10 513171b65a9c77db96c35810983ced3e7d0878765dbca8adf9f24c4a630498f3' >> /var/ossec/etc/client.keys
```
Where
- `001` is the desired agent ID
- `test` is the desired agent name
- `192.168.56.10` is the agent IP
- `513171b65a9c77db96c35810983ced3e7d0878765dbca8adf9f24c4a630498f3` is the previously generated token

4. Start the wazuh manager and check that the new agent exists:
```
# systemctl start wazuh-manager
# /var/ossec/bin/manage_agents -l

Available agents:
   ID: 001, Name: test, IP: 192.168.56.10
```

5. Now, add the same line to the agent's /var/ossec/etc/client.keys and start the agent
```
# echo '001 test 192.168.56.10 513171b65a9c77db96c35810983ced3e7d0878765dbca8adf9f24c4a630498f3' >> /var/ossec/etc/client.keys
# sudo systemctl daemon-reload
# sudo systemctl enable wazuh-agent
# sudo systemctl start wazuh-agent
```

6. Finally, you can check that the agent was connected successfully:
```
# /var/ossec/bin/agent_control -i 001

Wazuh agent_control. Agent information:
   Agent ID:   001
   Agent Name: test
   IP address: 192.168.56.10
   Status:     Active

   Operating system:    Linux |wazuh-agent |5.15.0-91-generic |#101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 |x86_64
   Client version:      Wazuh v4.14.2
   Configuration hash:  ab73af41699f13fdd81903b5f23d8d00
   Shared file hash:    e15cd0c9f7dec03be7b82012b99d73bf
   Last keep alive:     1770622357

   Syscheck last started at:  Mon Feb  9 07:21:26 2026
   Syscheck last ended at:    Mon Feb  9 07:21:27 2026
```