Install Wazuh SIEM Threat Detection on VPS
Home › Install Wazuh SIEM Threat Detection on VPS

Install Wazuh SIEM Threat Detection on VPS

June 2026 · 8 min read

Wazuh is an open-source SIEM and HIDS platform that consolidates security monitoring in one place — detecting intrusions, analyzing logs, checking file integrity (FIM), scanning vulnerabilities, and verifying compliance with a dashboard that shows everything at a glance. It's ideal for administrators managing multiple VPS servers who want to know instantly when someone attempts to breach the system, critical files are modified, or malware is detected. This article focuses on installing an all-in-one Wazuh setup on a single VPS and adding agents to other servers.

System Requirements

The Wazuh server (Indexer + Manager + Dashboard) consumes reasonable resources and should run on a dedicated VPS for monitoring:

Install Wazuh All-in-One

# Download and run the assisted installer
curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

# When complete, it displays the dashboard admin username and password
# Open https://YOUR_VPS_IP (port 443)
# Retrieve the admin password from:
sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt
Note: The installer sets up Wazuh Indexer (OpenSearch), Manager, and Dashboard simultaneously. This takes several minutes and consumes high RAM during indexing — do not install on a VPS that is already running production services.

Add Agent on Servers to Monitor

Install an agent on each VPS that needs monitoring to send data back to the Wazuh server:

# On the agent machine (Ubuntu/Debian)
curl -sO https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent.deb
sudo WAZUH_MANAGER="WAZUH_SERVER_IP" dpkg -i ./wazuh-agent.deb

sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

# On the server side, verify the agent is connected
sudo /var/ossec/bin/agent_control -l

Enable File Integrity Monitoring (FIM)

FIM sends alerts immediately when critical files are modified — a classic sign of a breach. Edit /var/ossec/etc/ossec.conf:

<syscheck>
  <directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
  <directories check_all="yes" realtime="yes">/var/www</directories>
  <frequency>43200</frequency>
</syscheck>

# restart agent
sudo systemctl restart wazuh-agent

After setting up the monitoring system, enhance it further with FIM and custom rules specific to the applications running on your server. This enables Wazuh to detect events that are contextually relevant to your infrastructure, not just generic default rules.

Verify Wazuh is Working Correctly

Confirm that all services are running, agents are sending events, and alerts are triggered when real events occur:

# 1. All main services are running
sudo systemctl status wazuh-manager wazuh-indexer wazuh-dashboard

# 2. Check how many agents are online (Active)
sudo /var/ossec/bin/agent_control -l

# 3. Test alerts by intentionally failing login multiple times, then check alerts
sudo tail -f /var/ossec/logs/alerts/alerts.json | grep -i "authentication"

# 4. Test FIM by modifying a file in a monitored path and verify the event appears
sudo touch /etc/test-fim && sudo tail -n5 /var/ossec/logs/alerts/alerts.log
Tip: If the dashboard appears but shows no data, check filebeat on the server (filebeat test output) — this component forwards alerts from the Manager to the Indexer. If filebeat crashes, the dashboard remains empty even though agents are sending data normally.

Common Issues & Troubleshooting

Dashboard Won't Open / Returns 503

The Indexer is not ready (consumes high RAM on startup) or there isn't enough RAM available. Check:

sudo systemctl status wazuh-indexer
free -h        # If RAM is full, add more RAM or reduce JVM heap
curl -k -u admin:PASSWORD https://localhost:9200

Agent Shows "Never connected"

The firewall is blocking ports 1514/1515 between the agent and server. Open the ports and verify the agent key:

# On the server
sudo ufw allow 1514,1515/tcp
# Re-register the agent if the key doesn't match
sudo /var/ossec/bin/manage_agents

Disk Fills Rapidly from Indexer

Old logs accumulate in the Indexer. Set an Index Management Policy (ISM) to automatically delete indexes older than N days via Dashboard > Index Management

Too Many Alerts Causing Noise

Adjust the rule level threshold for alerts (for example, alert only on level ≥ 10) and tune rules that frequently generate false positives in /var/ossec/etc/rules/local_rules.xml

Frequently Asked Questions

How is Wazuh different from Fail2ban?

Fail2ban focuses on blocking IPs based on pattern-matched logs at a specific point. Wazuh is a complete security monitoring platform — it aggregates logs from multiple servers, performs file integrity monitoring, scans vulnerabilities, and validates compliance with a unified dashboard. Both can work together effectively.

Can I run Wazuh on a small VPS?

The all-in-one server requires at least 8 GB RAM and is not suitable for 1-2 GB VPS instances. However, the agent consumes very little resources and can be installed on small VPS that you want to monitor.

How long can logs be retained?

It depends on your disk space and the ISM policy you set. Typically, hot indexes are retained for 30-90 days before being deleted or archived. If compliance requirements demand longer retention, plan for adequate disk space and consider separate cold storage.

Related Articles