Wazuh

I noticed today that Wazuh wasn’t working after I restarted my server. I saw in the logs it was failing the bootstrap test. I thought the issue was the mass of file permission error that were appearing before this error showed. However after messing around with file permissions I noticed a error about sysctl vm.max_map_count after running “sysctl -w vm.max_map_count=262144” it started working however I have no idea how this wasn’t a issue until now.

I was originaly planing to try security onion but while reasurching it I came across Wazuh which runs on docker which I always prefer. Once I installed it using a edited version of the compose file in the github repository. I managed to install the agent on two of my servers however on my main proxmox host I didn’t understand that the server I was the ip of the main host not the server I was installing it on. This lead to a botched install I haven’t been able to fix yet. ...