Wazuh Agent Installation Guide: Linux, Windows and macOS

The Wazuh agent is the lightweight collector you install on every endpoint and server you want to monitor. It forwards logs, security events, FIM data, vulnerability scan results and more to the Wazuh manager. This guide covers the supported installers for Linux, Windows and macOS, then shows how to enroll the agent and confirm it is reporting.

Before you install

• The Wazuh manager is reachable from the endpoint on TCP/1514 (default).
• You have the manager IP or DNS name handy.
• You will install as root (Linux), Administrator (Windows) or with sudo (macOS).

Install on Linux (deb-based)

For Ubuntu and Debian, install the package directly from packages.wazuh.com. Replace `<MANAGER_IP>` with your manager address:

curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.0-1_amd64.deb && \
sudo WAZUH_MANAGER='<MANAGER_IP>' dpkg -i ./wazuh-agent.deb

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

rpm-based (RHEL, CentOS, Rocky, Alma, Amazon Linux)

curl -so wazuh-agent.rpm https://packages.wazuh.com/4.x/yum/wazuh-agent-4.9.0-1.x86_64.rpm && \
sudo WAZUH_MANAGER='<MANAGER_IP>' rpm -ihv wazuh-agent.rpm

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Install on Windows

On Windows the agent ships as an MSI. Run an elevated PowerShell, then:

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi -OutFile $env:tmp\wazuh-agent.msi

msiexec.exe /i $env:tmp\wazuh-agent.msi /q WAZUH_MANAGER='<MANAGER_IP>' WAZUH_REGISTRATION_SERVER='<MANAGER_IP>'

NET START WazuhSvc

Confirm the service status in Services.msc, you should see `Wazuh` running.

Install on macOS

Download and install the signed pkg, then start the service. For Apple silicon:

curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.arm64.pkg && \
sudo launchctl setenv WAZUH_MANAGER '<MANAGER_IP>' && \
sudo installer -pkg ./wazuh-agent.pkg -target /

sudo /Library/Ossec/bin/wazuh-control start

For Intel Macs replace `arm64` with `intel64` in the package name.

Verify enrollment on the manager

On the Wazuh server, list connected agents:

sudo /var/ossec/bin/agent_control -l

You should see your new endpoint with status `Active`. Inside the Wazuh dashboard it will also appear under Agents within a minute.

Common issues

• Agent stuck on `Never connected`: confirm the manager IP is correct and TCP/1514 is open in both directions.
• Time skew: the agent and manager clocks must be within a few minutes of each other, enable NTP on both.
• Linux SELinux/AppArmor: check `/var/ossec/logs/ossec.log` for permission denials.

For multi-tenant or large fleet rollouts we use group-based registration, agentless enrollment via configuration management and dedicated registration certificates. If you are planning a fleet deployment, our team can help design the enrollment workflow.