Every command below comes from the Wazuh 5.0-beta documentation. The manager and Linux agent commands were run on a 5.0.0-beta5 lab stack, and the Windows agent commands on a Windows 11 endpoint enrolled against it. The macOS lines are documented rather than exercised. Manager tools live in /var/wazuh-manager/bin, agent tools in /var/ossec/bin on Linux, /Library/Ossec/bin on macOS. If you are still on 4.x, the paths differ and several of these tools do not exist yet or no longer exist; the ports and paths reference has both versions side by side.
Service control
All four components ship a systemd unit. Service names are unchanged from 4.x.
| Command | What it does |
|---|---|
systemctl start wazuh-indexer |
Starts the Wazuh indexer |
systemctl start wazuh-manager |
Starts the Wazuh manager |
systemctl start wazuh-dashboard |
Starts the Wazuh dashboard |
systemctl start wazuh-agent |
Starts the Wazuh agent |
systemctl status wazuh-manager |
Shows manager service state |
systemctl restart wazuh-indexer |
Restarts the indexer, needed after editing opensearch.yml |
systemctl enable wazuh-agent |
Starts the agent at boot |
systemctl disable wazuh-agent |
Stops the agent starting at boot |
systemctl daemon-reload |
Reloads unit files after installing the agent package |
Start order on a fresh install is indexer, then manager, then dashboard. The dashboard logs “Wazuh dashboard server is not ready yet” until the indexer answers on 9200.
Without systemd
| Command | What it does |
|---|---|
service wazuh-agent start |
SysV init equivalent on Debian and RPM systems |
chkconfig --add wazuh-agent |
Registers the agent service on RPM-based SysV systems |
update-rc.d wazuh-agent defaults 95 10 |
Registers the agent service on Debian-based SysV systems |
/var/ossec/bin/wazuh-control start |
Starts the agent where no service manager is present |
launchctl bootstrap system /Library/LaunchDaemons/com.wazuh.agent.plist |
Starts the agent on macOS |
NET START WazuhSvc |
Starts the agent from CMD on Windows |
Start-Service WazuhSvc |
Starts the agent from PowerShell on Windows |
Restart-Service WazuhSvc |
Restarts the Windows agent after a configuration change |
Get-Service WazuhSvc |
Shows the Windows agent service state |
The Windows service is WazuhSvc, display name Wazuh, start type Automatic, and the MSI leaves it stopped. Verified on 5.0.0-beta5: Get-Service *wazuh* returns that one service and nothing else. Beta documentation pages using Restart-Service -Name wazuh or net stop wazuh do not match the package.
Windows agent one-liners
| Command | What it does |
|---|---|
msiexec /i wazuh-agent-5.0.0-beta5.msi /q WAZUH_MANAGER="<IP>" WAZUH_REGISTRATION_PASSWORD="<PASSWORD>" |
Silent install with the two documented deployment properties |
msiexec.exe /x wazuh-agent-5.0.0-beta5.msi /qn |
Silent uninstall, with the original MSI in the working directory |
Get-AuthenticodeSignature .\wazuh-agent-5.0.0-beta5.msi |
Checks the package signature, which should be Valid and signed by CN="Wazuh, Inc" |
Select-String -Path 'C:\Program Files (x86)\ossec-agent\wazuh-agent.state' -Pattern "^status" |
Reads the agent connection state |
Get-Content 'C:\Program Files (x86)\ossec-agent\ossec.log' -Tail 20 |
Reads the agent log, including enrolment and clock skew lines |
Get-Content 'C:\Program Files (x86)\ossec-agent\VERSION.json' |
Prints version, stage and commit, the best detection target for Intune or SCCM |
Test-NetConnection -ComputerName <IP> -Port 1517 |
Tests the agent to manager path |
Manager process control: wazuh-manager-control
Replaces ossec-control and the manager side of wazuh-control. Path: /var/wazuh-manager/bin/wazuh-manager-control.
| Command | What it does |
|---|---|
wazuh-manager-control start |
Starts the manager services |
wazuh-manager-control stop |
Stops the manager services |
wazuh-manager-control restart |
Restarts the manager services |
wazuh-manager-control status |
Lists each manager daemon and whether it is running |
wazuh-manager-control info |
Prints version, stage and commit as JSON |
wazuh-manager-control info -v |
Prints the version, for example v5.0.0 |
wazuh-manager-control info -r |
Prints the package revision |
wazuh-manager-control info -t |
Prints the installation type |
wazuh-manager-control enable debug |
Puts every manager daemon into debug mode |
wazuh-manager-control disable debug |
Turns debug mode off again |
-j |
An option, not a command: adds it to a wazuh-manager-control call to get JSON output for monitoring scripts |
A healthy status on 5.0.0-beta5 lists eight daemons:
/var/wazuh-manager/bin/wazuh-manager-control statuswazuh-manager-clusterd is running...
wazuh-manager-modulesd is running...
wazuh-manager-monitord is running...
wazuh-manager-remoted is running...
wazuh-manager-analysisd is running...
wazuh-manager-db is running...
wazuh-manager-authd is running...
wazuh-manager-apid is running...wazuh-manager-monitord is in that list. The GitHub migration guide says it is going and its work moves into the Task Manager inside modulesd; beta5 still ships it and still starts it, so count eight until a later build says otherwise. If one is missing, the reason is almost always in /var/wazuh-manager/logs/wazuh-manager.log.
info without a flag prints the build as JSON, which is the fastest way to record exactly what you are running:
{
"version": "5.0.0",
"stage": "beta5",
"commit": "49b96be"
}Agent process control: wazuh-control
Path is /var/ossec/bin/wazuh-control on Linux and /Library/Ossec/bin/wazuh-control on macOS.
| Command | What it does |
|---|---|
wazuh-control start |
Starts the agent services |
wazuh-control stop |
Stops the agent services |
wazuh-control restart |
Restarts the agent services |
wazuh-control reload |
Reloads the agent configuration |
wazuh-control status |
Lists each agent daemon and whether it is running |
wazuh-control info -v |
Prints the agent version |
wazuh-control enable debug |
Debug mode for every agent daemon |
wazuh-control disable debug |
Turns agent debug mode off |
A healthy agent status lists five daemons, confirmed on a 5.0.0-beta5 Linux agent: wazuh-modulesd, wazuh-logcollector, wazuh-syscheckd, wazuh-agentd and wazuh-execd. grep ^status /var/ossec/var/run/wazuh-agentd.state is the companion check and reads status='connected' or status='pending'. If wazuh-agentd is the only one missing, read why the agent is disconnected.
Manager CLI tools
All of these live in /var/wazuh-manager/bin. That directory holds sixteen entries on 5.0.0-beta5, and the list is the authoritative answer to “does this tool still exist”:
ls /var/wazuh-manager/binagent_groups
agent_upgrade
cluster_control
rbac_control
verify-agent-conf
wazuh-manager-analysisd
wazuh-manager-apid
wazuh-manager-authd
wazuh-manager-clusterd
wazuh-manager-control
wazuh-manager-db
wazuh-manager-keystore
wazuh-manager-modulesd
wazuh-manager-monitord
wazuh-manager-remoted
wazuh-manager-service-controlFive administrative tools, eight daemons, plus wazuh-manager-control and wazuh-manager-service-control. No manage_agents, no agent-auth, no agent_control, no wazuh-logtest.
agent_groups
Groups must exist before an agent enrols into them, so this is the tool you reach for first.
| Command | What it does |
|---|---|
agent_groups -a -g <group> |
Creates a group |
agent_groups -a -i <agent_id> -g <group> |
Adds an agent to an existing group |
agent_groups -r -g <group> |
Removes a group |
agent_groups -r -i <agent_id> -g <group> |
Removes an agent from a group |
agent_groups -l |
Lists existing groups |
agent_groups -l -g <group> |
Lists the agents in a group |
agent_groups -s -i <agent_id> |
Shows the groups an agent belongs to |
agent_groups -c -g <group> |
Lists the configuration files of a group with their checksums |
agent_groups -f |
Forces an agent to belong to a single group |
agent_groups -q |
Silent mode, skips the confirmation prompt |
What creating and listing groups looks like on beta5:
$ /var/wazuh-manager/bin/agent_groups -a -g lab-linux -q
Group 'lab-linux' created.
$ /var/wazuh-manager/bin/agent_groups -l
Groups (2):
default (0)
lab-linux (0)
Unassigned agents: 0.The number in brackets is the agent count in that group, and Unassigned agents is the one to watch after a rollout. More on the model in agent groups and centralised configuration.
agent_upgrade
| Command | What it does |
|---|---|
agent_upgrade -l |
Lists outdated agents with their current version |
agent_upgrade -a <agent_id> |
Upgrades one agent to the latest available version |
agent_upgrade -a <id> <id> ... |
Upgrades several agents in one call |
agent_upgrade -a <id> -v <version> |
Upgrades to a specific version |
agent_upgrade -a <id> -f <file.wpk> |
Installs a custom WPK package |
agent_upgrade -a <id> -F |
Forces the upgrade, skipping version validation |
agent_upgrade --package_type deb |
Chooses the Linux package type, rpm or deb |
agent_upgrade -r <repository> |
Uses an alternative package repository |
agent_upgrade -a <id> -s |
Suppresses output |
cluster_control
| Command | What it does |
|---|---|
cluster_control -l |
Lists cluster nodes with type, version and address |
cluster_control -a |
Lists every registered agent and the node it reports to |
cluster_control -i |
Shows cluster health |
cluster_control -fn <node> |
Filters the output by node name |
cluster_control -fs <status> |
Filters the agent list by agent status |
Every Wazuh 5.0 install is a cluster, even a single node, so this tool works on an all-in-one box. See cluster and distributed architecture.
rbac_control
| Command | What it does |
|---|---|
rbac_control change-password |
Changes the password of the default API users wazuh and wazuh-wui; a blank answer leaves one unchanged |
rbac_control factory-reset |
Wipes all custom RBAC users, roles, policies and rules; asks you to type RESET |
verify-agent-conf
| Command | What it does |
|---|---|
verify-agent-conf |
Validates every agent.conf in the shared configuration directory |
verify-agent-conf -f <path> |
Validates one agent.conf file |
Run it before you restart the manager after editing group configuration. A bad agent.conf is pushed to every agent in the group.
wazuh-manager-keystore
Stores credentials and connection settings outside the configuration file.
| Command | What it does |
|---|---|
wazuh-manager-keystore -f <column_family> -k <key> -v <value> |
Stores a value against a key |
wazuh-manager-keystore -f <column_family> -k <key> -vp <path> |
Reads the value from a single-line file |
wazuh-manager-keystore -h |
Prints usage |
Omit both -v and -vp and the tool reads the value from standard input, which keeps it out of shell history.
Installation utilities
Run before or during deployment, not from an installed manager.
| Command | What it does |
|---|---|
bash wazuh-install.sh -a |
All-in-one install of indexer, manager and dashboard |
bash wazuh-install.sh -a -id -d pre-release |
The beta form: installs dependencies and uses the pre-release repository |
bash wazuh-install.sh -wi <node> |
Installs only the indexer, for a distributed deployment |
bash wazuh-install.sh -wm <node> |
Installs only the manager |
bash wazuh-install.sh -wd <node> |
Installs only the dashboard |
bash wazuh-install.sh -g |
Generates wazuh-install-files.tar from config.yml |
bash wazuh-install.sh -s |
Initialises indexer cluster security settings |
bash wazuh-install.sh -o |
Overwrites an existing install, erasing configuration and data |
bash wazuh-install.sh -u |
Uninstalls all Wazuh components |
bash wazuh-install.sh -V |
Prints the script and package versions |
bash wazuh-certs-tool.sh -A |
Creates every certificate in config.yml plus the admin certificates |
bash wazuh-certs-tool.sh -ca |
Creates only the root CA |
bash wazuh-certs-tool.sh -wi <ca.pem> <ca.key> |
Creates indexer certificates from an existing CA |
bash wazuh-certs-tool.sh -wm <ca.pem> <ca.key> |
Creates manager certificates |
bash wazuh-certs-tool.sh -wd <ca.pem> <ca.key> |
Creates dashboard certificates |
bash wazuh-passwords-tool.sh -u <user> -p <password> |
Changes an indexer user password |
bash wazuh-passwords-tool.sh -A -au <api_user> -ap <api_pass> -u <user> -p <password> |
Changes an indexer user password and the matching API user |
The -d pre-release flag exists because 5.0 is still in beta. It drops at general availability. Walkthrough in installing Wazuh on Ubuntu.
Manager API one-liners
The manager API listens on 55000/TCP. Default credentials after an assisted install are wazuh:wazuh. Get a token first; it expires after 900 seconds by default.
TOKEN=$(curl -u <USER>:<PASSWORD> -k -X POST "https://<WAZUH_MANAGER_IP>:55000/security/user/authenticate?raw=true")| Command | What it does |
|---|---|
curl -k -X GET "https://<IP>:55000/agents?pretty=true&sort=-ip,name" -H "Authorization: Bearer $TOKEN" |
Lists enrolled agents |
curl -k -X POST -d '{"name":"<AGENT_NAME>"}' "https://<IP>:55000/agents?pretty=true" -H "Content-Type:application/json" -H "Authorization: Bearer $TOKEN" |
Enrols an agent and returns its id and key |
curl -k -X GET "https://<IP>:55000/agents/<ID>/key?pretty=true" -H "Authorization: Bearer $TOKEN" |
Retrieves an existing agent’s client key |
curl -k -X POST "https://<IP>:55000/groups?pretty=true" -H "Content-Type: application/json" -d '{"group_id": "Linux"}' -H "Authorization: Bearer $TOKEN" |
Creates a group |
curl -k -X PUT "https://<IP>:55000/agents/<ID>/group/<GROUP>?pretty=true" -H "Authorization: Bearer $TOKEN" |
Assigns an agent to a group |
curl -k -X DELETE "https://<IP>:55000/agents/<ID>/group/<GROUP>" -H "Authorization: Bearer $TOKEN" |
Removes an agent from a group |
curl -k -X GET "https://<IP>:55000/groups/<GROUP>/agents?pretty=true&select=id,name" -H "Authorization: Bearer $TOKEN" |
Lists the agents in a group |
curl -k -X DELETE "https://<IP>:55000/agents?pretty=true&older_than=0s&agents_list=012,014&status=all" -H "Authorization: Bearer $TOKEN" |
Removes named agents |
curl -k -X DELETE "https://<IP>:55000/agents?pretty=true&older_than=21d&agents_list=all&status=never_connected,disconnected" -H "Authorization: Bearer $TOKEN" |
Removes agents that have been silent for 21 days |
The surviving endpoint families in 5.0 are /agents, /groups, /cluster, /mitre, /security and /overview. /manager, /rules, /decoders, /lists, /logtest, /syscheck, /rootcheck, /syscollector, /sca, /tasks and /active-response are not in the 5.0 API specification. Worked examples in the Wazuh API with Python, and the full list on the manager API reference.
Indexer API one-liners
The indexer API listens on 9200/TCP and is where state, events and findings now live.
| Command | What it does |
|---|---|
curl -k -u <USER>:<PASS> https://<INDEXER_IP>:9200 |
Checks the indexer answers and prints its version |
curl -k -u <USER>:<PASS> https://<INDEXER_IP>:9200/_cat/nodes?v |
Lists indexer cluster nodes |
curl -X GET <INDEXER_IP>:9200/_cat/indices?v |
Lists indices and backing indices with size and document count |
curl -sk -o /dev/null -w '%{http_code}\n' -u <USER>:<PASS> https://<INDEXER_IP>:9200/_cluster/health |
Returns just the HTTP status, handy for credential checks |
curl -fks https://localhost:9200/_plugins/_security/health |
Security plugin health, used by the Docker healthcheck |
curl -k -u <USER>:<PASS> "https://<INDEXER_IP>:9200/_nodes?filter_path=**.mlockall&pretty" |
Confirms memory locking is on |
curl -k -u <USER>:<PASS> "https://<INDEXER_IP>:9200/_nodes/stats/process?filter_path=**.max_file_descriptors&pretty" |
Checks the file descriptor limit |
curl -X POST "https://<INDEXER_IP>:9200/_flush" -u <USER>:<PASS> -k |
Flushes indices before a snapshot |
curl -X GET <INDEXER_IP>:9200/_index_template/ |
Lists index templates created by the Setup module |
curl -sk -u <USER>:<PASS> -X POST "https://<INDEXER_IP>:9200/_plugins/_content_manager/integrations" -H 'Content-Type: application/json' -d @integration.json |
Creates content. Collection endpoints under _content_manager are POST-only on beta5; a GET answers 405 with allowed: [POST] |
Search findings by any Wazuh Common Schema field:
curl -sk -u <USER>:<PASS> -X GET "https://127.0.0.1:9200/wazuh-findings-v5-*/_search" -H 'Content-Type: application/json' -d'
{
"query": {
"term": {
"wazuh.case.status": { "value": "acknowledged" }
}
}
}'Content management, log test and space promotion all sit under /_plugins/_content_manager/, and detection under /_plugins/_security_analytics/. The indexer API reference lists every group.
Logs to tail
| Command | What it does |
|---|---|
tail -f /var/wazuh-manager/logs/wazuh-manager.log |
Manager log, including the generated enrolment password on first start |
tail -f /var/ossec/logs/ossec.log |
Agent log on Linux |
tail -f /Library/Ossec/logs/ossec.log |
Agent log on macOS |
tail -f /var/ossec/logs/active-responses.log |
Active response execution results on Linux |
tail -f /var/log/wazuh-indexer/wazuh-indexer.log |
Indexer log |
journalctl -u wazuh-dashboard |
Dashboard log; the dashboard does not write its own file by default |
cat /var/ossec/var/run/wazuh-agentd.state |
Agent connection statistics file |
cat /var/ossec/var/run/wazuh-logcollector.state |
Per-file log collection counters on the agent |
Get-Content 'C:\Program Files (x86)\ossec-agent\wazuh-logcollector.state' |
The same counters on Windows, as JSON, one entry per event channel or file |
curl -k -X GET "https://<IP>:55000/cluster/<NODE>/daemons/stats?daemons_list=wazuh-manager-analysisd" -H "Authorization: Bearer $TOKEN" |
Manager daemon statistics; replaces the removed wazuh-analysisd.state and wazuh-remoted.state files |
The manager no longer writes alerts.json or alerts.log. Everything goes to the indexer through the indexer connector, so the equivalent of “tail the alerts file” is now a query against wazuh-events-v5* or wazuh-findings-v5*. See reading your first findings.
Commands that no longer exist in 5.0
These are in the 4.x tools reference and not in the 5.0 one. If a blog post or an old runbook tells you to run one of them on a 5.0 manager, it predates the rewrite.
| 4.x command | Status in 5.0 | Use instead |
|---|---|---|
manage_agents |
Confirmed absent from /var/wazuh-manager/bin on beta5. Still present on the agent in /var/ossec/bin |
Manager API POST /agents, or agent_groups for group membership |
agent-auth |
Confirmed absent from /var/wazuh-manager/bin on beta5 |
Agent-side enrolment through <agent><manager> in ossec.conf |
agent_control |
Not in the 5.0 tools reference | cluster_control -a, or GET /agents |
wazuh-logtest |
Not in the 5.0 tools reference | Indexer API /_plugins/_content_manager/logtest/normalization and /logtest/detection |
wazuh-regex |
Not in the 5.0 tools reference | Decoders parse with logpar, not regex; see writing a custom decoder |
clear_stats |
Not in the 5.0 tools reference | Not documented in the beta |
fim_migrate |
Not in the 5.0 tools reference | Not applicable; FIM state lives in wazuh-states-fim-* |
update_ruleset |
Deprecated in 4.2, gone in 5.0 | Content Manager syncs standard content from Wazuh CTI |
wazuh-keystore |
Renamed | wazuh-manager-keystore |
ossec-control |
Renamed | wazuh-manager-control on the manager, wazuh-control on the agent |
Next: Wazuh ports, paths and log files reference.
Frequently asked questions
Where are the Wazuh command line tools installed?
On a Wazuh 5.0 manager they live in /var/wazuh-manager/bin. On a Wazuh agent they live in /var/ossec/bin on Linux, /Library/Ossec/bin on macOS, and the installation folder under Program Files on Windows. In Wazuh 4.x the manager tools were also in /var/ossec/bin, which is the single most common source of copied commands that no longer work.
Does manage_agents still exist in Wazuh 5.0?
Not on the manager. Listing /var/wazuh-manager/bin on a 5.0.0-beta5 manager returns sixteen tools and neither manage_agents nor agent-auth is among them. On the agent it survives: /var/ossec/bin on a 5.0 agent still ships manage_agents. Use the manager API or agent_groups for anything manager-side.
How do I restart Wazuh without systemd?
Run /var/wazuh-manager/bin/wazuh-manager-control restart on the manager and /var/ossec/bin/wazuh-control restart on a Linux agent. Both tools also take start, stop, status and info. The agent tool additionally accepts reload.