# wazuh-log-collection

Companion files for the lesson **Wazuh Log Collection: Syslog, Journald, Windows Events**:
<https://maheshtata.com/wazuh/wazuh-log-collection/>

Tested against: Wazuh 5.0 (beta5 documentation, September 2026), Ubuntu 24.04.
The Windows event channel defaults and indexed field names were verified on a
Wazuh 5.0.0-beta5 agent on Windows 11 Pro build 26200 (23 Sep 2026). Wazuh 5.0
is in beta. Re-check against the release documentation at GA.

| File | Where it goes |
| --- | --- |
| `localfile-linux-files.xml` | Between the `<ossec_config>` tags of `/var/ossec/etc/ossec.conf` on a Linux agent. |
| `localfile-journald.xml` | Same file. systemd journal collection with field filters. |
| `localfile-windows-eventchannel.xml` | Between the `<ossec_config>` tags of `C:\Program Files (x86)\ossec-agent\ossec.conf`. Read the header first: beta5 already ships Application, Security (filtered), System and the active response log. |
| `localfile-command.xml` | Command output through Logcollector. |
| `wodle-command.xml` | The Command module, with hash verification and scheduling. |
| `localfile-multiline.xml` | Tracebacks, stack traces and fixed-line records. |
| `rsyslog-10-remote.conf` | `/etc/rsyslog.d/10-remote.conf` on the syslog relay host. |
| `agent.conf` | `/var/wazuh-manager/etc/shared/<GROUP_NAME>/agent.conf` on the manager. |

## The two remote-command gates

They are different settings and people confuse them. Both live in
`/var/ossec/etc/local_internal_options.conf` on the agent
(`C:\Program Files (x86)\ossec-agent\local_internal_options.conf` on Windows,
`/Library/Ossec/local_internal_options.conf` on macOS).

| Feature | Setting |
| --- | --- |
| `<localfile>` with `log_format` `command` or `full_command`, distributed through `agent.conf` | `logcollector.remote_commands=1` |
| `<wodle name="command">` distributed through `agent.conf` | `wazuh_command.remote_commands=1` |

Neither gate applies to a command written directly into that endpoint's own
`ossec.conf`. Anyone who can write the shared `agent.conf` can run commands as
root on every agent in the group, so treat write access to
`/var/wazuh-manager/etc/shared/` as production change control.

## Agent paths in 5.0

The manager moved to `/var/wazuh-manager`. The agent did not. Agent configuration
is still `/var/ossec/etc/ossec.conf` on Linux, `/Library/Ossec/etc/ossec.conf` on
macOS and `C:\Program Files (x86)\ossec-agent\ossec.conf` on Windows, with
`<ossec_config>` as the root element.