The Wazuh agent reads logs through the logcollector module. Each source is declared with a <localfile> block in ossec.conf (or in shared agent.conf for group-wide rollouts).
Plain text log file
<localfile>
<log_format>syslog</log_format>
<location>/var/log/auth.log</location>
</localfile>Windows Event Channel
<localfile>
<location>Security</location>
<log_format>eventchannel</log_format>
<query>Event/System[EventID=4625 or EventID=4624]</query>
</localfile>systemd journald
<localfile>
<log_format>journald</log_format>
<location>journald</location>
<filter field="_SYSTEMD_UNIT">^sshd.service$</filter>
</localfile>Command output
<localfile>
<log_format>full_command</log_format>
<command>df -P</command>
<frequency>360</frequency>
</localfile>JSON logs (auditd, app logs)
<localfile>
<log_format>json</log_format>
<location>/var/log/myapp/app.json</location>
</localfile>Note: After every change restart the agent: systemctl restart wazuh-agent. Use ossec-logtest on the manager to verify decoders match.
We onboard 100+ log sources (firewalls, EDR, SaaS) into a single Wazuh tenant, contact us for log onboarding.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhLog Collectionlocalfile