Wazuh Agent Not Connecting: Causes and Fixes

A freshly enrolled Wazuh agent should appear as Active on the manager within a minute. When it does not, the cause is almost always one of six things. Work through this list in order.

0. Read the agent log first

# Linux / macOS
sudo tail -n 100 /var/ossec/logs/ossec.log

# Windows (elevated PowerShell)
Get-Content "C:\Program Files (x86)\ossec-agent\ossec.log" -Tail 100

The log almost always contains the exact failure reason. Pattern-match it against the sections below.

1. Firewall and network reachability

Verify TCP/1514 (events) and TCP/1515 (enrollment) are open from the agent to the manager:

# From the agent
nc -vz <MANAGER_IP> 1514
nc -vz <MANAGER_IP> 1515

On the manager side check the listening sockets: `ss -tlnp | grep -E "1514|1515"`. Cloud security groups, host firewalls and corporate proxies are the usual blockers.

2. Clock skew

Wazuh refuses connections when the agent and manager clocks drift more than a few minutes apart:

timedatectl   # ensure NTP is enabled and synchronized

3. Mismatched or missing client keys

Look at `/var/ossec/etc/client.keys` on the agent and `/var/ossec/etc/client.keys` on the manager, the entry must match (same ID, same key). If you re-installed the manager without backing up keys, every agent needs to re-enroll.

# Re-enroll
/var/ossec/bin/agent-auth -m <MANAGER_IP>
systemctl restart wazuh-agent

4. Manager bound to the wrong interface

On the manager, check `/var/ossec/etc/ossec.conf`:

<remote>
  <connection>secure</connection>
  <port>1514</port>
  <protocol>tcp</protocol>
  <queue_size>131072</queue_size>
</remote>

If `<local_ip>` is set to a single interface that agents cannot reach, change it to the externally reachable IP and restart the manager.

5. Enrollment service down

systemctl status wazuh-manager
/var/ossec/bin/wazuh-control status

The `wazuh-authd` process must be running on the manager for enrollment to succeed.

6. SSL certificate / hostname mismatch

If you enabled `auth_pass` or registration via SSL certs, agent and manager must trust the same CA, and the manager certs Subject Alternative Name must match the address agents use. Regenerate the cert bundle with the official `wazuh-certs-tool.sh` if needed.

After every fix

systemctl restart wazuh-agent
# Wait 30 seconds, then check on the manager
/var/ossec/bin/agent_control -l

If you have worked through this list and the agent still wont connect, open a support request, our team can help diagnose deeper issues like asymmetric routing, MTU problems or multi-NIC binding.