Wazuh shutdown order

[Abdi Farhan]

Hi team, I'd like to restart my server this night. Is there any specific order to shutdown wazuh components? I'm on wazuh 4.9 if that helps. Thanks in advance. 

[Jorge Eduardo Molas]

  Hi,

  For a clean server restart with Wazuh 4.9, there is a recommended order based on component dependencies.

  Shutdown order (stop services in this sequence):

sudo systemctl stop wazuh-dashboard sudo systemctl stop wazuh-indexer sudo systemctl stop wazuh-manager

​

  Startup order (start services in this sequence after server reboot):

sudo systemctl start wazuh-manager sudo systemctl start wazuh-indexer sudo systemctl start wazuh-dashboard

​

The logic behind this order follows the data flow: the Manager generates events, the Indexer stores them, and the Dashboard queries the Indexer. When stopping, you shut down the components that depend on others first (Dashboard depends on Indexer, Indexer receives from Manager). When starting, you bring up the foundation first.
Verify all services are running after ra estart:

sudo systemctl status wazuh-manager sudo systemctl status wazuh-indexer sudo systemctl status wazuh-dashboard

​

If all components are on a single server, you can also check the Manager's daemons with:

/var/ossec/bin/wazuh-control status

​

 If your agents lose connectivity during the server downtime, they will automatically reconnect and sync their queued events once the Manager is back online.

References:
- https://documentation.wazuh.com/current/user-manual/reference/tools/wazuh-control.html