How to Setup Wazuh Cluster for Production Use

Why This Matters

Running Wazuh as a single node is fine for a lab or a small team. But in production, a single node is a liability — one failure and your entire security monitoring goes dark.

A Wazuh cluster gives you high availability, load distribution, and the ability to scale as your environment grows. This guide walks you through setting up a production-grade Wazuh cluster — step by step, no shortcuts.

What We Are Building

A production Wazuh cluster consists of three tiers:

Prerequisites

Before you start, make sure you have the following in place.

Minimum hardware for each node:

Operating System - Ubuntu 22.04 LTS / RHEL 8+

CPU - 4 vCPU

RAM - 8 GB (16 GB Recommended)

Disk - 100 GB SSD

Network - 1 Gbps, low latency

Server inventory for this guide:

Wazuh Master Node (wazuh-master) - 192.168.1.10

Wazuh Worker Node (wazuh-worker-01) - 192.168.1.11

Wazuh Indexer Node (wazuh-indexerr-01) - 192.168.1.20

Wazuh Indexer Node (wazuh-indexerr-02) - 192.168.1.21

Wazuh Indexer Node (wazuh-indexerr-03) - 192.168.1.22

Wazuh Dashboard (wazuh-dashboard) - 192.168.1.30

Adjust IPs and hostnames to match your environment.

Step 1 — Prepare All Nodes

Do this on every server before installing any Wazuh component.

1.1 Set Hostnames

bash

1.2 Update /etc/hosts on All Nodes

Add all cluster node entries to /etc/hosts on every machine:

bash

1.3 Sync Time Across All Nodes

Wazuh clustering is sensitive to time drift. Use chrony or ntpd to keep all nodes in sync.

bash

Make sure all nodes show the same reference time source.

1.4 Configure Firewall Rules

Open the required ports on each node type.

On Wazuh Manager nodes:

bash

On Wazuh Indexer nodes:

bash

On Wazuh Dashboard:

bash

Step 2 — Generate SSL Certificates

Wazuh uses TLS for all internal communication. You generate certificates once and distribute them to all nodes.

2.1 Download the Wazuh Cert Tool

Run this on any one node (you will copy certs to others):

bash

2.2 Edit config.yml

This file tells the tool about all your nodes.

yaml

2.3 Generate the Certificates

bash

This creates a wazuh-certificates/ directory with individual cert archives for each node.

2.4 Distribute Certificates

Copy the correct cert package to each node:

bash

Repeat for all nodes.

Step 3 — Install and Configure Wazuh Indexer Cluster

The Wazuh Indexer is an OpenSearch-based component. Set it up as a 3-node cluster for production resilience.

3.1 Add Wazuh Repository

Run on each indexer node:

bash

3.2 Install Wazuh Indexer

bash

3.3 Configure opensearch.yml

Edit /etc/wazuh-indexer/opensearch.yml on each indexer node.

On wazuh-indexer-01:

yaml

Adjust network.host and node.name on indexer-02 and indexer-03 accordingly.

3.4 Deploy Certificates on Indexer Nodes

bash

3.5 Start and Initialize Wazuh Indexer

Start the service on all three indexer nodes:

bash

Then initialize the security plugin. Run this only once, from indexer-01:

bash

Verify the cluster is healthy:

bash

You should see "status": "green" and "number_of_nodes": 3.

Step 4 — Install and Configure Wazuh Manager Cluster

4.1 Install Wazuh Manager on Both Nodes

Run on both master and worker:

bash

4.2 Configure ossec.conf — Master Node

Edit /var/ossec/etc/ossec.conf on the master node.

Find the <cluster> block and configure it:

xml

Generate your own key with: openssl rand -hex 32

Also configure the Wazuh Indexer connection within ossec.conf:

xml

4.3 Configure ossec.conf — Worker Node

Edit /var/ossec/etc/ossec.conf on the worker node. Same cluster block, but with node_type set to worker:

xml

The <key> must be identical on master and all workers.

4.4 Deploy Certificates on Manager Nodes

bash

4.5 Start Wazuh Manager on Both Nodes

bash

4.6 Verify Cluster Status

bash

Expected output:

Step 5 — Install Wazuh Dashboard

5.1 Install the Package

bash

5.2 Deploy Certificates

bash

5.3 Configure opensearch_dashboards.yml

Edit /etc/wazuh-dashboard/opensearch_dashboards.yml:

yaml

5.4 Start the Dashboard

bash

Access the dashboard at: https://192.168.1.30

Default credentials: admin / admin — change these immediately.

Step 6 — Enroll Wazuh Agents

6.1 Agent Enrollment Against the Cluster

For a clustered setup, agents should enroll via the master node and communicate through a load balancer or directly to the worker nodes.

For a simple setup without a load balancer, point agents at the master for enrollment and a worker for communication:

bash

6.2 Verify Agent Registration

On the master node:

bash

You should see your enrolled agent with status Active.

Step 7 — Production Hardening

7.1 Change Default Passwords

bash

Update the new password in opensearch_dashboards.yml and restart the dashboard.

7.2 Configure Index Lifecycle Management

Create an ILM policy to manage index retention and rollover:

bash

Adjust min_index_age and min_size to match your data volume requirements.

7.3 Enable Vulnerability Detection

In ossec.conf on the master node, enable the vulnerability detector:

xml

Restart the manager:

bash

7.4 Configure Email Alerts

Add SMTP configuration to ossec.conf:

xml

7.5 Tune Alert Levels

Review and tune rules to reduce false positives. Custom rules go in /var/ossec/etc/rules/local_rules.xml:

xml

Step 8 — Verify Everything Is Running

Run these checks to confirm your cluster is healthy end to end.

bash

All services should show active (running). The indexer cluster should show "status": "green".

Quick Reference — Important Paths

Wrapping Up

You now have a production-ready Wazuh cluster with:

1. A 2-node manager cluster (master + worker) with shared cluster key
2. A 3-node indexer cluster for resilience and performance
3. TLS encryption across all communication
4. Enrolled agents reporting to the cluster
5. Basic production hardening in place

From here, you can scale by adding more worker nodes (just add them with the same cluster key), expand the indexer cluster, and layer in integrations like TheHive, MISP, or a SIEM ticketing workflow.