Wazuh Agent Reinstall

[kl3ss]

Hey All

Was just wondering about the following:

If we have a machine with a wazuh agent installed on it and we then rebuild that machine it seems we have to go remove the agent entry for the wazuh manager before we reinstall and re-register the agent. Is there a way to not pull the current key and agent details after re-installing the agent? The machine is typically being rebuilt with the same name and same ip address.

Cheers

kl3ss

[wildlyunder]

You need to add the following code to /opt/so/conf/wazuh/ossec.conf

<auth>
    <disabled>no</disabled>
    <port>1515</port>
    <use_source_ip>no</use_source_ip>
    <force_insert>yes</force_insert>
    <force_time>0</force_time>
    <!-- other auth tags -->
</auth>

Then restart wazuh sudo so-wazuh -estart