You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,6 +48,7 @@ All notable changes to this project will be documented in this file.
48
48
-**Post-release**: Changed the warning note on using the `$` and `&` characters when changing passwords in Docker deployments. ([#8694](https://github.com/wazuh/wazuh-documentation/pull/8694))
49
49
-**Post-release**: Changed Windows commands in the backup guide to PowerShell. ([#8761](https://github.com/wazuh/wazuh-documentation/pull/8761))
:description:Check the tasks that help you benefit the most from the installation of Wazuh after the installation of the Wazuh-Docker.
5
-
4
+
:description:Perform several tasks to manage and customize your installation after deploying Wazuh with Docker.
5
+
6
6
Wazuh Docker utilities
7
7
======================
8
8
9
-
After installing the Wazuh-Docker containers, there are several tasks you can do to benefit the most from your Wazuh installation.
10
-
11
-
..
12
-
.. contents::
13
-
:local:
14
-
:depth: 1
15
-
:backlinks: none
9
+
After deploying Wazuh with Docker, you can perform several tasks to manage and customize your installation. Wazuh components are deployed as separate containers built from their corresponding Docker image. You can access these containers using the service names defined in your ``docker-compose.yml`` file, which are specific to your deployment type.
16
10
17
11
Access to services and containers
18
12
---------------------------------
19
13
20
-
#. Access the Wazuh dashboard using the Docker host IP address. For example, ``https://localhost``, if you are on the Docker host.
21
-
22
-
.. note::
23
-
24
-
In case you use a self-signed certificate, your browser will warn that it cannot verify its authenticity.
25
-
26
-
#. Enroll the agents by following the standard enrollment process and using the Docker host address as the manager address. For more information, see the :doc:`Wazuh agent enrollment </user-manual/agent/agent-enrollment/index>` documentation.
14
+
This section explains how to interact with your Wazuh deployment by accessing service logs and shell instances of running containers.
27
15
16
+
#. Access the Wazuh dashboard using the Docker host IP address.
17
+
#. Enroll agents through the standard :doc:`Wazuh agent enrollment </user-manual/agent/agent-enrollment/index>` process. Use the Docker host address as the Wazuh manager address.
28
18
#. List the containers in the directory where the Wazuh ``docker-compose.yml`` file is located:
29
19
30
20
.. code-block:: console
@@ -39,42 +29,112 @@ Access to services and containers
#. Run the command below from the directory where the ``docker-compose.yml`` file is located to access the command line of each container:
32
+
#. Run the command below from the directory where the ``docker-compose.yml`` file is located to open a shell inside the container:
43
33
44
34
.. code-block:: console
45
35
46
36
# docker-compose exec <SERVICE> bash
47
37
38
+
Tuning Wazuh services
39
+
---------------------
40
+
41
+
You can tune the Wazuh indexer and Wazuh dashboard by replacing their default configuration with custom parameters. This allows you to adjust performance settings, change the dashboard interface, or override default options.
42
+
43
+
Tuning the Wazuh indexer
44
+
^^^^^^^^^^^^^^^^^^^^^^^^
45
+
46
+
The Wazuh indexer uses a default internal configuration that is not exposed by default. Follow the steps below to override the default configuration:
Replace ``<new_wazuh_indexer>`` with your new service name.
55
+
56
+
#. Map your configuration file inside the container in the ``docker-compose.yml`` file. Update the Wazuh indexer container declaration to:
57
+
58
+
.. code-block:: yaml
59
+
:emphasize-lines: 4,5,7
60
+
61
+
<new_wazuh_indexer>:
62
+
image: wazuh/wazuh-indexer:latest
63
+
ports:
64
+
- "9200:9200"
65
+
- "9300:9300"
66
+
environment:
67
+
ES_JAVA_OPTS: "-Xms6g -Xmx6g"
68
+
networks:
69
+
- docker_wazuh
70
+
71
+
Tuning the Wazuh dashboard
72
+
^^^^^^^^^^^^^^^^^^^^^^^^^^
73
+
74
+
The Wazuh dashboard reads its configuration from ``config/wazuh_dashboard/opensearch_dashboards.yml``. Edit this file to customize the Wazuh dashboard with your desired settings. After making changes, restart the Wazuh Docker container for the updates to take effect.
75
+
76
+
Refer to the OpenSearch documentation on `Modifying the YAML files <https://docs.opensearch.org/latest/security/configuration/yaml/>`__ for details about the available variables you can override in this configuration.
77
+
48
78
Wazuh service data volumes
49
79
--------------------------
50
80
51
-
You can set Wazuh configuration and log files to exist outside their containers. This allows the files to persist after removing containers, and you can provision custom configuration files to your containers.
81
+
You can set Wazuh configuration and log files to exist outside their containers. This allows the files to persist after containers are removed, and you can provision custom configuration files to your containers.
52
82
53
-
You need multiple volumes to ensure persistence on a Wazuh container. The following is an example of a ``docker-compose.yml`` with persistent volumes:
83
+
Adding a persistent volume
84
+
^^^^^^^^^^^^^^^^^^^^^^^^^^
54
85
55
-
.. code-block:: yaml
86
+
You need multiple volumes to ensure persistence on a Wazuh container. Here’s an example of defining a persistent volume in your ``docker-compose.yml`` file:
You can list persistent volumes with ``docker volume ls``:
100
+
Listing existing volumes
101
+
^^^^^^^^^^^^^^^^^^^^^^^^
102
+
103
+
Run the following to see the persistent volumes on your Docker host:
104
+
105
+
.. code-block:: console
106
+
107
+
# docker volume ls
67
108
68
109
.. code-block:: none
69
110
:class: output
70
111
71
-
DRIVER VOLUME NAME
72
-
local single-node_wazuh_api_configuration
112
+
DRIVER VOLUME NAME
113
+
local single-node_wazuh_api_configuration
114
+
115
+
Wazuh indexer volumes
116
+
^^^^^^^^^^^^^^^^^^^^^
117
+
118
+
By default, single‑node and multi‑node deployments include preconfigured volumes for the Wazuh indexer.
119
+
120
+
For example, in a multi-node deployment, the ``wazuh1.indexer`` service uses the following volume (as defined in ``wazuh-docker/multi-node/docker-compose.yml``):
121
+
122
+
.. code-block:: yaml
123
+
:emphasize-lines: 4
124
+
125
+
wazuh1.indexer:
126
+
...
127
+
volumes:
128
+
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
129
+
130
+
This ensures that Wazuh indexer data remains available even if the container is restarted or rebuilt.
73
131
74
132
Storage volume for Wazuh indexer and dashboard
75
133
----------------------------------------------
76
134
77
-
Attaching a volume for the storage of Wazuh indexer data is also possible. By default, the single-node and multi-node deployments already have volumes configured. An example of a single-node wazuh indexer volume is shown in the ``docker-compose.yml`` below:
135
+
You can also attach volumes to store Wazuh indexer data. By default, single‑node and multi‑node Docker deployments include preconfigured volumes.
136
+
137
+
The example below shows a single-node Wazuh indexer volume in the ``docker-compose.yml`` file:
78
138
79
139
.. code-block:: yaml
80
140
@@ -88,14 +148,47 @@ Attaching a volume for the storage of Wazuh indexer data is also possible. By de
88
148
volumes:
89
149
wazuh-indexer-data
90
150
91
-
92
151
Custom commands and scripts
93
152
---------------------------
94
153
95
-
To execute commands in the Wazuh manager container, you can execute a shell:
154
+
Run the command below to execute commands inside the containers. We use the Wazuh manager ``single-node-wazuh.manager-1`` container in this example:
Every change made on this shell persists as long as you have the data volumes configured correctly.
160
+
Every change made on this shell persists if you properly configure data volumes.
161
+
162
+
Modifying the Wazuh configuration file
163
+
--------------------------------------
164
+
165
+
To customize the Wazuh configuration file ``/var/ossec/etc/ossec.conf``, modify the appropriate configuration file on the Docker host according to your business needs. These local files are mounted into the containers at runtime, allowing your custom settings to persist across container restarts or rebuilds.
166
+
167
+
#. Run the following command in your deployment directory to stop the running containers:
168
+
169
+
.. code-block:: console
170
+
171
+
# docker-compose down
172
+
173
+
#. The following are the locations of the Wazuh configuration files on the Docker host that you can modify:
These files are mounted into the container at runtime (``/wazuh-config-mount/etc/ossec.``), ensuring your changes take effect when the containers start.
0 commit comments