Agent Deploy Amazon Linux 2

[Andrew A]

I want to deploy agents on amazon linux 2 -- hopefully the correct way. 

Reading the docs here: 

https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html

It doesn't provide any instructions on all the other options I get when I'm deploying via wazuh WUI. It looks like there are specific agents deployed to specific operating systems. 

Which should you select when deploying to amazon linux 2?

Thanks, 

Andrew

[Andres Micalizzi]

Hi Andre.
Thanks for using Wazuh.

You can deploy on Amazon Linux systems with an rpm package from the packages list from the ones in the Amazon section, or you can deploy by installing from the repo by following the Yum steps in the documentation that you linked in your message.

If you want to install from a specific package, say for example x86_64 package, you could follow this steps to install the current agent from the packages list:

1. Log into the agent's machine
2. Download the package with curl -OL https://packages.wazuh.com/4.x/yum/wazuh-agent-4.3.6-1.x86_64.rpm
3. Install the package with: WAZUH_MANAGER="<MANAGER-AUTH-IP>" yum install wazuh-agent-4.3.6-1.x86_64.rpm
4. Start the Agent: 
   
   systemctl daemon-reload
   
   systemctl enable wazuh-agent
   
   systemctl start wazuh-agent
5. Optionally: You can register the agent in the manager from the agent with /var/ossec/bin/agent_auth -m <MANAGER-AUTH-IP> -A <AGENT-NAME>
   

I hope this clears your question. In case of further doubts do not hesitate to ask.
Cheers,
Andrés

[Andrew A]

Appreciate the response. 

So, when I go to my wazuh web interface and go to "Agents" then deploy new agents 

After I fill out everything it gives me this: 

sudo WAZUH_MANAGER='(mymanagerIP)' WAZUH_AGENT_GROUP='Linux-Prod' yum install https://packages.wazuh.com/4.x/yum/wazuh-agent-4.3.6-1.x86_64.rpm

I assume this is the same exact thing because the URL is the same. I just wanted to make sure I was downloading the correct agent. Because when you do it in WUI it asks you what version of linux you have. I assume that is only for the command lines that you'll be using -- and every agent is ultimately the same. 

[Andres Micalizzi]

Yes, every agent for a specific package format is the same. You would use the same package for Amazon Linux, RHEL or Centos 8 for example since they are .rpm systems that use the yum package manager.

That command is correct.