Wazuh Manager Cluster (Master-Worker) Setup

A Wazuh manager cluster splits agent connections across multiple nodes. One node is the master (owns the ruleset and configuration), all others are workers that pull configuration from the master and accept agent connections. The supported limit is around 25 nodes and 100k agents per cluster.

1. Configure the master node

Edit /var/ossec/etc/ossec.conf on the master:

<cluster>
  <name>wazuh</name>
  <node_name>master-node</node_name>
  <node_type>master</node_type>
  <key>c98b62a9b6169ac5f67dae55ae4a9088</key>
  <port>1516</port>
  <bind_addr>0.0.0.0</bind_addr>
  <nodes>
    <node>10.0.0.20</node>
  </nodes>
  <hidden>no</hidden>
  <disabled>no</disabled>
</cluster>

2. Configure each worker node

Same block, but change node_name and node_type:

<node_name>worker-01</node_name>
<node_type>worker</node_type>

3. Use the same cluster key everywhere

Generate a 32-character key once and copy it to every node:

openssl rand -hex 16

4. Restart the manager on every node

systemctl restart wazuh-manager

5. Verify cluster status

/var/ossec/bin/cluster_control -l
/var/ossec/bin/cluster_control -a

We design Wazuh clusters with LB, HA storage and DR, reach out via contact.