Install Wazuh Agent on Linux (deb, rpm, Tarball)

The Wazuh agent runs on the endpoint you want to monitor and forwards data to the Wazuh manager over an encrypted channel. This guide follows the official deployment-variables method, which installs and enrolls the agent in a single command.

1. Add the Wazuh repository

APT (Debian/Ubuntu):

apt-get install gnupg apt-transport-https
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
apt-get update

YUM (RHEL/CentOS/Rocky/Alma/Amazon Linux):

rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-\$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

2. Install with deployment variables

Replace `<MANAGER_IP>` with your Wazuh manager address. Add `WAZUH_AGENT_GROUP` if you want to auto-assign a group.

# Debian/Ubuntu
WAZUH_MANAGER='<MANAGER_IP>' apt-get install wazuh-agent

# RHEL/CentOS
WAZUH_MANAGER='<MANAGER_IP>' yum install wazuh-agent

3. Enable and start the service

systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

Alternative: install from tarball

For locked-down systems without package management, download the package directly from packages.wazuh.com (see the official Packages list) and install with `dpkg -i` or `rpm -ivh`.

4. Verify enrollment

# On the manager
/var/ossec/bin/agent_control -l

The new endpoint should appear as Active. If the agent stays in Never connected, jump to our troubleshooting guide.