我如何在 windows 上激活 wazuh 代理，经理在 Ubuntu 虚拟机上

Question

i open VB with Ubuntu 22.04.1 LTS. and install wazuh all in one. after i log in to the elastic and add agent the problem start. It doesn't matter if I try to do it on another machine on my Windows or on a friend's Windows with a private network, it doesn't recognize the agent at all. i try my public and Private ip and nuthing.

the agent code i do is:

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.3.6-1.msi -OutFile ${env:tmp}\wazuh-agent-4.3.6.msi; msiexec.exe /i ${env:tmp}\wazuh-agent-4.3.6.msi /q WAZUH_MANAGER='localhost' WAZUH_REGISTRATION_SERVER='localhost' WAZUH_AGENT_GROUP='default'

and after:

NET START WazuhSvc

with my ip.And nothing happens. Has anyone encountered this or can help?

Answer 1

Checking your install and enrollment command we can see that you have set the WAZUH_REGISTRATION_SERVER to localhost. This should be replaced with your manager IP. In order to do that in a deployed Windows agent like your case change the configuration file ( C:\Program Files (x86)\ossec-agent\ossec.conf ) replacing the manager IP with the real one. For example:

<address>192.168.1.17</address>

Finally, restart your wazuh-agent.

In order to deploy and enroll new agents please remember to replace the localhost value with your real wazuh manager host in the Wazuh server address step.

Answer 2

Maybe you should go to this folder C:\Program Files (x86)\ossec-agent. and run win32ui as an admin, then click manage and restart the agent.