Wazuh Docker utilitiesPermalink to this headline

After deploying Wazuh with Docker, you can perform several tasks to manage and customize your installation. Wazuh components are deployed as separate containers built from their corresponding Docker image. You can access these containers using the service names defined in your docker-compose.yml file, which are specific to your deployment type.

Access to services and containersPermalink to this headline

This section explains how to interact with your Wazuh deployment by accessing service logs and shell instances of running containers.

  1. Access the Wazuh dashboard using the Docker host IP address.

  2. Enroll agents through the Wazuh agent Docker deployment or the standard Wazuh agent enrollment process. Use the Docker host address as the Wazuh manager address.

  3. List the containers in the directory where the Wazuh docker-compose.yml file is located:

    # docker compose ps
    Output
    NAME                            COMMAND                  SERVICE             STATUS              PORTS
single-node-wazuh.dashboard-1   "/entrypoint.sh"         wazuh.dashboard     running             443/tcp, 0.0.0.0:443->5601/tcp
single-node-wazuh.indexer-1     "/entrypoint.sh open…"   wazuh.indexer       running             0.0.0.0:9200->9200/tcp
single-node-wazuh.manager-1     "/init"                  wazuh.manager       running             0.0.0.0:1514-1515->1514-1515/tcp, 0.0.0.0:514->514/udp, 0.0.0.0:55000->55000/tcp, 1516/tcp

  4. Run the command below from the directory where the docker-compose.yml file is located to open a shell inside the container:

    # docker compose exec <SERVICE> bash

Wazuh service data volumesPermalink to this headline

You can set Wazuh configuration and log files to exist outside their containers on the host system. This allows the files to persist after containers are removed, and you can provision custom configuration files to your containers.

Listing existing volumesPermalink to this headline

Run the following to see the persistent volumes on your Docker host:

# docker volume ls
Output
DRIVER    VOLUME NAME
local     single-node_wazuh_api_configuration

You can also view these volumes in the volumes section directly from the docker-compose.yml file.

Adding a custom volumePermalink to this headline

You need multiple volumes to ensure persistence on the Wazuh server, Wazuh indexer, and Wazuh dashboard containers. Investigate the volumes section in your docker-compose.yml file and modify it to include your custom volumes:

services:
  wazuh.manager:
    . . .
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
    . . .
volumes:
  wazuh_api_configuration:

Custom commands and scriptsPermalink to this headline

Run the command below to execute commands inside the containers. We use the Wazuh manager single-node-wazuh.manager-1 container in this example:

# docker exec -it single-node-wazuh.manager-1 bash

Every change made on this shell persists because of the data volumes.

Note

The actions you can perform inside the containers are limited.

Modifying the Wazuh configuration filePermalink to this headline

To customize the Wazuh configuration file /var/ossec/etc/ossec.conf, modify the appropriate configuration file on the Docker host according to your business needs. These local files are mounted into the containers at runtime, allowing your custom settings to persist across container restarts or rebuilds.

  1. Run the following command in your deployment directory to stop the running containers:

    # docker compose down

  2. The following are the locations of the Wazuh configuration files on the Docker host that you can modify:

    wazuh-docker/single-node/config/wazuh_cluster/wazuh_manager.conf

    Save the changes made in the configuration files.

  3. Restart the stack:

    # docker compose up -d

These files are mounted into the container at runtime (wazuh-config-mount/etc/ossec.conf), ensuring your changes take effect when the containers start.

Tuning Wazuh servicesPermalink to this headline

Tuning the Wazuh indexer and dashboard is optional. You can apply custom configurations only if you need to adjust performance, customize the dashboard interface, or override default settings.

  • The Wazuh indexer reads its configuration from the file(s) in the config/wazuh_indexer/ directory in your respective deployment stack. Edit the appropriate configuration file(s) with your desired parameters, and ensure any changes made are properly mapped in your docker-compose.yml so the container loads the updated configuration.

  • The Wazuh dashboard reads its configuration from the config/wazuh_dashboard/opensearch_dashboards.yml file. You can adjust dashboard behavior or appearance by modifying parameters in this file. Refer to the OpenSearch documentation on Modifying the YAML files for details about the available variables you can override in this configuration.