How to install wazuh agent on OKD 4.13 with fcos?

[wiqu85]

Hello everyone,
I have a question about the installation of the Wazuh agent in the OKD 4 node. In my company, Wazuh monitoring is standard and after migration from 3 to 4 we have a problem with it. Is it possible to install and run the Wazuh agent on fcos? How do you deal with the problem of monitoring events on hosts? Maybe you know some referral tools?

Thank you for your answer
Emil

[keremceliker]

Installing the Wazuh agent directly on Fedora CoreOS (FCOS) might not be straightforward due to FCOS's minimalistic design and focus on container workloads. However, you can still achieve Wazuh monitoring by taking an alternative approach:

1. Deploy a Linux VM:

   • Create a virtual machine (VM) running a Linux distribution compatible with Wazuh (e.g., CentOS, Ubuntu, or another distribution of your choice).
   • Install the Wazuh agent on this VM following the standard installation procedure.
   • Configure the agent to monitor the necessary logs and events on your hosts.

2. Containerize the Wazuh Agent:

   • Since FCOS is designed for container workloads, consider running the Wazuh agent as a container.
   • Create a Docker or Podman container with the Wazuh agent inside it.
   • Mount relevant directories (e.g., /var/log) from the host into the container to allow monitoring of host logs.
   • Ensure the container has network access to communicate with the Wazuh server.

3. Alternative Monitoring Tools:

   • If direct Wazuh agent installation is not feasible, explore other monitoring tools that work well with FCOS:
     • Prometheus and Grafana: Set up Prometheus for metrics collection and Grafana for visualization.
     • Sysdig: A container monitoring solution that provides security and performance insights.
     • Falco: A behavioral activity monitor for containers.
     • Auditd: Leverage the built-in Linux audit framework for host-level monitoring.

I hope it helps..

Best,
Kerem ÇELİKER
Head of Cloud Architecture
linkedin.com/in/keremceliker/