Generate alert if Wazuh-Manager down

[Haziq Mt Roslan]

Hi team,

I  have been wondering if there is a way to generate an alert if Wazuh-Manager is down. Is there any way to notify us about this problem? Thanks in advance.

 

[Himanshu Sharma]

Hi Team,

Thanks for using the Wazuh.

If the Wazuh manager service is down then it will not generate an alert. If the service is down then how it will produce the logs?

In general, if you want to monitor the status of the Wazuh services (wazuh-manager, wazuh-indexer, wazuh-dashboard and filebeat) You will need to use another application because is not possible for any application that is down to report anything. One application that you can use to monitor this is Zabbix In this application, you can execute automatically any command like:

# systemctl status wazuh-manager

In a specified frequency and trigger notifications under certain results via email for example. For more information about Zabbix, please check:
https://www.zabbix.com/

Another option would be to run a script, say every 5 minutes, that posts a message to PagerDuty whenever one of the 4 services is not running.

Hope this information helps you. Please feel free to reach out to us for any information/issues.
Regards,

[Haziq Mt Roslan]

Hi team,

Another option would be to run a script, say every 5 minutes, that posts a message to PagerDuty whenever one of the 4 services is not running.

Is there any documentation that I can refer for this and instead can I use slack rather than Pager duty? Thanks in advance ya..