wazuh应用之主机安装agent及触发告警邮件

server端：
#/var/ossec/bin/manage_agent

agent端：
安装Wazuh agent

1. 添加Wazuh存储库：

#rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
#cat > /etc/yum.repos.d/wazuh.repo <<\EOF
[wazuh_repo]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=Wazuh repository
baseurl=https://packages.wazuh.com/3.x/yum/
protect=1
EOF

2.安装
#yum install wazuh-agent

3. 配置ossec.conf中的manage_ip为服务端ip

[root@localhost ~]# vim /var/ossec/etc/ossec.conf

<ossec_config>
  <client>
    <server>
      <address>服务端IP</address>
      <port>1514</port>
      <protocol>udp</protocol>

4.导入服务端的key

[root@localhost ~]# /var/ossec/bin/manage_agents


****************************************
* Wazuh v3.13.1 Agent manager.         *
* The following options are available: *
****************************************
   (I)mport key from the server (I).
   (Q)uit.
Choose your action: I or Q: I

* Provide the Key generated by the server.
* The best approach is to cut and paste it.
*** OBS: Do not include spaces or new lines.

Paste it here (or '\q' to quit): 服务端生成的对应密钥输这里

Agent information:
   ID:001
   Name:192.168.3.114
   IP Address:192.168.3.114

Confirm adding it?(y/n): Y
Added.


****************************************
* Wazuh v3.13.1 Agent manager.         *
* The following options are available: *
****************************************
   (I)mport key from the server (I).
   (Q)uit.
Choose your action: I or Q: Q

manage_agents: Exiting.
[root@localhost ~]#

5.重启服务
systemctl restart wazuh-agent