Wazuh SIEM Deployment: Complete Error Resolution Guide

说明与用途

在实验室环境中部署 Wazuh SIEM 的指南，解决嵌套虚拟化、版本不匹配和仪表板迁移问题。

问题

Deploying Wazuh SIEM often fails due to nested virtualization, version mismatches, disk space, certificate errors, and migration bugs.

结果

Following the guide resolves common deployment errors, enabling a fully functional Wazuh SIEM in lab environments within 2–4 hours.

工作流

• 1. Avoid nested virtualization; use separate VMs for infrastructure and agents.
• 2. For nested environments, enable VM processor virtualization (VT‑x/EPT or AMD‑V/RVI) in VMware settings.
• 3. Verify agent and manager versions; upgrade manager to match newer agent if needed.
• 4. Add Wazuh repository and run apt update/upgrade for manager and indexer.
• 5. Restart wazuh-manager and wazuh-indexer services.
• 6. Resolve dashboard migration bugs by following specific upgrade steps or using recommended versions.
• 7. Monitor logs with journalctl to confirm no errors remain.
• 8. Apply prevention strategies: keep components separate, avoid running VMs inside VMs, and maintain version parity.

证据

WSL2 is unable to start since virtualization is not enabled on this machine. Error code: Wsl/InstallDistro/Service/RegisterDistro/CreateVm/HCS_E_HYPERV_NOT_INSTALLED

来源

WARNING: Couldn't connect to server '192.168.84.130': 'Agent version must be lower or equal to manager version'

来源