You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: source/development/client-keys.rst
+73-69Lines changed: 73 additions & 69 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,94 +8,98 @@
8
8
Client keys file
9
9
================
10
10
11
-
The ``client.keys`` file stores the data used to authenticate secure agents.
12
-
13
-
Location
14
-
--------
15
-
16
-
UNIX systems
17
-
Folder ``etc`` inside the installation directory.
18
-
19
-
Windows agents
20
-
Installation directory.
11
+
The ``client.keys`` file stores the data used to authenticate and identify Wazuh agents. A record of the ``client.keys`` file is stored on the Wazuh server and the Wazuh agent endpoints. The location depends on the operating system. The table below lists the default paths for each OS:
This file contains one line per each agent entry. In the case of agents, only one line is allowed, and this line must match exactly one entry in the ``client.keys`` file at manager, otherwise the agent will be rejected.
26
+
The Wazuh manager ``client.keys`` file contains one entry per agent. The Wazuh agent ``client.keys`` file has one line, which must match an entry on the Wazuh manager. If the lines don't match, the Wazuh manager rejects the Wazuh agent.
27
+
28
+
The ``client.keys`` file is formatted as described in the table below:
26
29
27
30
::
28
31
29
32
<ID> <Name> <Address> <Password>
30
33
31
-
**ID**
32
-
33
-
Agent identification number.
34
-
35
-
+--------------------+---------------+
36
-
| Allowed characters | Digits only |
37
-
+--------------------+---------------+
38
-
| Allowed size | 3 to 8 digits |
39
-
+--------------------+---------------+
40
-
| Padding | 0-padded |
41
-
+--------------------+---------------+
42
-
| Unique value | Yes |
43
-
+--------------------+---------------+
44
-
| Reserved values | ID "000" |
45
-
+--------------------+---------------+
46
-
47
-
**Name**
48
-
49
-
Name of the agent.
34
+
Where:
35
+
36
+
- **ID** - represents the Wazuh agent identification number with the following considerations:
37
+
38
+
+--------------------+---------------+
39
+
| Allowed characters | Digits only |
40
+
+--------------------+---------------+
41
+
| Allowed size | 3 to 8 digits |
42
+
+--------------------+---------------+
43
+
| Padding | 0-padded |
44
+
+--------------------+---------------+
45
+
| Unique value | Yes |
46
+
+--------------------+---------------+
47
+
| Reserved values | ID "000" |
48
+
+--------------------+---------------+
49
+
50
+
- **Name** - represents the name of the agent with the following considerations:
- **Address** - represents the allowed source IP address range in CIDR format. If the IP address is explicitly provided, the Wazuh manager will only enroll the agent if the provided IP address matches the source IP address.
String that will take part in the external message encryption.
82
+
Void entries
83
+
------------
76
84
77
-
+--------------------+----------------------+
78
-
| Allowed characters | Printable characters |
79
-
+--------------------+----------------------+
80
-
| Allowed size | Up to 128 bytes |
81
-
+--------------------+----------------------+
82
-
| Unique value | No |
83
-
+--------------------+----------------------+
85
+
Key entries can be invalidated, causing the associated Wazuh agent to be considered as unenrolled. This can occur in the following cases:
84
86
85
-
Void entries
86
-
~~~~~~~~~~~~
87
+
- The entire line is deleted.
88
+
- The line begins with ``#`` or whitespace.
89
+
- The agent name starts with ``#`` or ``!``.
87
90
88
-
Key entries can be invalidated so the related agent is considered removed: the line is discarded.
91
+
.. note::
89
92
90
-
- Line starting with ``#`` or whitespace.
91
-
- Agent name starting with ``#`` or ``!``.
93
+
The Wazuh manager needs to be stopped before invalidating a key to ensure proper un-enrolling.
92
94
93
95
Examples
94
-
~~~~~~~~
96
+
--------
97
+
98
+
Below is an example of the content of the ``client.keys`` file. The last agent ``004`` meets one of the conditions for a void entry because the agent name ``!data3`` starts with ``!``.
95
99
96
100
::
97
101
98
102
001 server1 any bb8a28997c6c3964eacb3d32308072f6661f567a41105b2b0b09f1a82331b937
Copy file name to clipboardExpand all lines: source/development/coredump.rst
+43-37Lines changed: 43 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,82 +6,88 @@
6
6
Configuring core dump generation
7
7
================================
8
8
9
-
A *core dump* or *crash dump* is a snapshot of a process's memory taken when a serious or unhandled error occurs. The operating system on a monitored endpoint can automatically generate core dumps. These dumps are valuable for diagnosing hanging processes. Alongside environment information, such as the operating system version, they can offer insights into the cause of a crash.
9
+
A core dump or crash dump is a snapshot of the memory of a processtaken when a program terminates abnormally, such as due to a crash or unhandled error. The operating system on a monitored endpoint can automatically generate core dumps. These dumps are valuable for diagnosing frozen processes. Alongside environment information, such as the operating system version, they offer insights into the cause of a crash.
10
10
11
11
Red Hat based OSs
12
12
-----------------
13
13
14
-
#. Edit the Systemd ``/etc/systemd/system.conf`` file. Add the following lines.
14
+
Follow the steps below to enable core dump on RedHat based systems:
15
+
16
+
#. Edit the ``/etc/systemd/system.conf`` file and add the following lines.
15
17
16
18
.. code-block:: console
17
19
18
20
DumpCore=yes
19
21
DefaultLimitCORE=infinity
20
22
21
-
#. Edit the Systemd ``/etc/sysctl.d/core.conf`` file. Add the following lines.
23
+
#. Edit the ``/etc/sysctl.d/core.conf`` file and add the following lines:
#. Create directory ``/var/lib/coredumps`` and grant it permissions ``773``.
31
+
#. Create the ``/var/lib/coredumps`` directory and grant it permissions ``773``:
32
+
33
+
.. code-block:: console
34
+
35
+
# mkdir /var/lib/coredumps
36
+
# chmod 700 /var/lib/coredumps
30
37
31
-
#. Reboot the system
38
+
#. Reboot the system.
32
39
33
-
#. After system reboot set the core ``ulimit`` to ``unlimited`` in your terminal.
40
+
#. After system reboot, set the core ``ulimit`` to ``unlimited`` in your terminal:
34
41
35
42
.. code-block:: console
36
43
37
44
# ulimit -c unlimited
38
45
# sysctl -p
39
46
40
-
#. Restart wazuh agent:
47
+
#. Restart the Wazuh agent:
41
48
42
49
.. code-block:: console
43
50
44
-
# ./var/ossec/bin/wazuh-control restart
51
+
# /var/ossec/bin/wazuh-control restart
45
52
46
53
47
54
Debian based OSs
48
55
----------------
49
56
50
57
In Linux version 2.41 and later, a template defines the location and name of the generated `core dump files <https://man7.org/linux/man-pages/man5/core.5.html>`__. Earlier versions generate the core dump files next to the location of the file that caused the error.
51
58
52
-
Using `systemd`
53
-
^^^^^^^^^^^^^^^
59
+
Using systemd
60
+
^^^^^^^^^^^^^
54
61
55
-
Systemd allows centralized management and configuration of core dumps across your system. To set up core dump generation with systemd, use the built-in features as follows.
62
+
Systemd allows centralized management and configuration of core dumps across your system. To set up core dump generation with systemd, use the built-in features as follows:
56
63
57
-
#. Check that the Systemd core dump unit socket is active.
64
+
#. Install the Systemd core dump package:
58
65
59
66
.. code-block:: console
60
67
61
-
# systemctl status systemd-coredump*
68
+
# apt install systemd-coredump
62
69
63
-
.. code-block:: none
64
-
:class: output
65
-
:emphasize-lines: 3
70
+
#. Check that the Systemd core dump unit socket is active:
66
71
67
-
● systemd-coredump.socket - Process Core Dump Socket
#. Add the following lines in the editor that opens to enable core dump collection and set external core dump storage. To disable core dump generation you must set ``Storage=none``.
83
+
#. Edit the ``/etc/systemd/coredump.conf`` file, and add the following lines to enable core dump collection and set external core dump storage. To disable core dump generation you must set ``Storage=none``.
78
84
79
85
.. code-block:: console
80
86
81
87
[Coredump]
82
88
Storage=external
83
89
84
-
#. **Recommended** – Set a size limit for core dump files. For example, 2 GB.
90
+
#. **Recommended** – Add this configuration to the ``/etc/systemd/coredump.conf`` file to set a size limit for core dump files. For example, 2 GB.
85
91
86
92
.. code-block:: console
87
93
@@ -91,13 +97,13 @@ Systemd allows centralized management and configuration of core dumps across you
91
97
92
98
.. code-block:: console
93
99
94
-
# systemctl restart systemd-coredump
100
+
# systemctl restart systemd-coredump.socket
95
101
96
-
#. Check the status of the systemd-coredump service to ensure it is running without errors.
102
+
#. Check the status of the systemd-coredump service to ensure it is running without errors:
97
103
98
104
.. code-block:: console
99
105
100
-
# systemctl status systemd-coredump
106
+
# systemctl status systemd-coredump.socket
101
107
102
108
#. To check the generated core dump files, take a look at the default ``/var/lib/systemd/coredump/`` directory. To find out the filename pattern for these files, run the following command.
103
109
@@ -108,7 +114,7 @@ Systemd allows centralized management and configuration of core dumps across you
@@ -121,7 +127,7 @@ Setting up core dump generation without using systemd involves configuring the o
121
127
122
128
# ulimit -c unlimited
123
129
124
-
#. Set the core dump file location and pattern. For example, to set the the ``/var/core/`` directory and the filename pattern ``core.%e.%p``, where ``%e`` represents the executable name and ``%p`` represents the process ID, run the following command.
130
+
#. Set the core dump file location and pattern. For example, to set the ``/var/core/`` directory and the filename pattern ``core.%e.%p``, where ``%e`` represents the executable name and ``%p`` represents the process ID, run the following command.
125
131
126
132
.. code-block:: console
127
133
@@ -133,20 +139,20 @@ Setting up core dump generation without using systemd involves configuring the o
133
139
134
140
Consider restarting relevant processes to ensure that the changes take effect.
135
141
136
-
#. **Recommended** – To preserve these changes across reboots, add the ``ulimit`` and ``echo`` commands above to a startup or system initialization script such as ``/etc/rc.local``.
142
+
#. We recommend preserving these changes across reboots. Add the ``ulimit`` and ``echo`` commands above to a startup or system initialization script such as ``/etc/rc.local``.
137
143
138
144
macOS endpoints
139
145
---------------
140
146
141
-
On macOS, most applications have core dump generation disabled by default. However, you can enable it using the ``ulimit`` command. To enable core dump generation on macOS follow these steps.
147
+
On macOS, most applications have core dump generation disabled by default. However, you can enable it using the ``ulimit`` command. To enable core dump generation on macOS follow these steps:
142
148
143
149
#. Set the core dump size limit to ``unlimited`` to enable core dump generation with complete debugging information. To disable it, set it to zero by running ``ulimit -c 0``. To check the current core dump size limit, run ``ulimit -c``.
144
150
145
151
.. code-block:: console
146
152
147
153
# ulimit -c unlimited
148
154
149
-
#. Set the core dump generation path and filename pattern. For example, to set the ``/cores/`` directory and the filename pattern ``core.%P``, where ``%P`` is the process ID, run the following command.
155
+
#. Set the core dump generation path and filename pattern. For example, to set the ``/cores/`` directory and the filename pattern ``core.%P``. Where ``%P`` is the process ID, run the following command.
150
156
151
157
.. code-block:: console
152
158
@@ -162,7 +168,7 @@ To collect user-mode crash dumps on Windows, you can use the Windows Error Repor
162
168
Accessing the Windows Registry
163
169
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
164
170
165
-
#. Press **Windows + R** keys on your keyboard to open the **Run** dialog box.
171
+
#. Press **Windows** + **R** keys on your keyboard to open the Run dialog box.
166
172
167
173
#. Type ``regedit`` in the search box and click **OK** to open the Registry editor.
168
174
@@ -177,15 +183,15 @@ Configuring Windows Error Reporting
0 commit comments