Agents 'Never Connected' but are on Dashboard
Hey all.
I started my wazuh server and am trying to get an agent active. I have followed all the steps to add an agent. I tried an Ubuntu VM and my personal windows 11 laptop. I cant get any of the active on the dashboard. I have check firewall rules, looked at logs, and restarted the agents and servers. I just cant seem to find the problem. Any suggestions?
1 Reply
CassandraD
Linode Staff
I started by using our guide to deploying the Wuzah Marketplace App.
Once the app was installed and I was connected to my home page, I used the create agent button and followed the instructions there rather than following the guide. I ran into a different issue and no agents were being created. This turned out to be because I confused the IPs of my Agent and my Wuzah instance.
Either way, it would be helpful to make sure that your agent configuration files are set up correctly. To investigate this, log into the agent server and check the configuration file to ensure that the Wuzah instance's IP address is configured. You should see something like this:
cat /var/ossec/etc/ossec.conf | grep address
<address>45.33.96.161</address>
I messed up the instructions the first time and used the IP from the agent not the Wuzah instance, so the results were showing my agent server's IP. I had to manually update that with a text editor (I used Nano). After that my homepage had an active agent showing.
I wasn't able to go through any additional troubleshooting steps because that got it working for me, but you can find more troubleshooting help in Wuzah's Documentation.
That said, I think that those steps should be helpful. You can find specific logs files to check there. While you said you looked at logs, you didn't mention which logs, so I'm hoping something in there is useful. Either way, if you share any log output or errors, our Community may be able to offer some additional guidance.
If their official Troubleshooting guides don't help, I'd recommend reaching out to their Community as well. Since everyone there will be familiar with the product, I think it's more likely someone there will have had this problem before.