yahoo_1999/fk-wazuh

Files

T

Jesus Garcia f04ed6e608 Update documentation for Wazuh Docker image builder and workflow usage

---
- All relevant content of README.md files was migrated to docs/ section in their respective section.
- These README files has been deleted (4 files)
- All README.md files (additional to the project's root and docs/) have been edited.
---
- Both files build-docker-images/README.md and docs/dev/build-image.md have almost same content, so it was discarded the README file
- As the directory and docker image are going to be disused, the certs-gen documentation contents of indexer-certs-creator/README.md was not mig>
- The 'bash' command added to the docs/dev/build-image.md was removed
- Added workflow usage docs file to the the SUMMARY.md file
---
- Removed '$' parameter and added 'bash' to all markdown code blocks headings (```)
---

2025-12-22 08:36:09 -05:00

2.6 KiB

Raw Blame History

Wazuh Docker Deployment

Deploying Wazuh Docker in a Multi-Node Configuration

This deployment utilizes the multi-node/docker-compose.yml file, which defines a cluster setup with two Wazuh Manager, three Wazuh Indexer, and one Wazuh Dashboard containers. Follow these steps to deploy this configuration:

Increase vm.max_map_count on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
```
sudo sysctl -w vm.max_map_count=262144
```
Note: This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the /etc/sysctl.conf file, add vm.max_map_count=262144, and then apply the change with sudo sysctl -p.
Navigate to the multi-node directory within your repository:
```
cd multi-node
```

Download the certificate creation script and config.yml file:

curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh
curl -sO https://packages.wazuh.com/5.0/config.yml

Edit the config.yml file with the configuration of the Wazuh components to be deployed

nodes:
  # Wazuh indexer server nodes
  indexer:
    - name: wazuh1.indexer
      ip: wazuh1.indexer
    - name: wazuh2.indexer
      ip: wazuh2.indexer
    - name: wazuh3.indexer
      ip: wazuh3.indexer

  # Wazuh server nodes
  # Use node_type only with more than one Wazuh manager
  server:
    - name: wazuh.master
      ip: wazuh.master
      node_type: master
    - name: wazuh.worker
      ip: wazuh.worker
      node_type: worker

  # Wazuh dashboard node
  dashboard:
    - name: wazuh.dashboard
      ip: wazuh.dashboard

Run the certificate creation script:
```
bash ./wazuh-certs-tool.sh -A
```
Start the Wazuh environment using docker compose:
- To run in the foreground (logs will be displayed in your current terminal; press Ctrl+C to stop):
```
docker compose up
```
- To run in the background (detached mode, allowing the containers to run independently of your terminal):
```
docker compose up -d
```

Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated.

2.6 KiB Raw Blame History

Wazuh Docker Deployment

Deploying Wazuh Docker in a Multi-Node Configuration

2.6 KiB

Raw Blame History