Skip to content
DnsLister Forum

Where domain hunters compare notes

Wazuh deploying but setting manager as 0.0.0.0

We deploy Wazuh across our small fleet of endpoints using powershell. We use the following command generated by Wazuh Dashboard:

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.14.7-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='wazuh.ourdomain.com' WAZUH_REGISTRATION_PASSWORD='PASSWORDREDACTED' WAZUH_AGENT_GROUP='Workstations' WAZUH_AGENT_NAME='AssetID'

We are finding that with a few deployments, not all of them, but enough to be annoying and time consuming, that agents are installing but setting the WAZUH_MANAGER to "0.0.0.0". We then have to go and manually edit the endpoint agents ossec.conf file to correct the issue.

My thought, and what I suspect, is that there may be a network blip that occurs when the DNS is resolving the manager name, and when it doesn't resolve in time it sets the location to 0.0.0.0.

Does anyone know how to avoid this issue at deployment?

Source: r/Wazuh · by /u/No-Emu-3822

Leave a Reply

Your email address will not be published. Required fields are marked *