Where Does Wazuh Store Config and Alert Data?
Where self hosted Wazuh keeps config and data on Linux servers, plus agent roles explained. Exact folders are covered below.
Last updated
Wazuh centers on its manager data directory. Configs, rules, agent keys, and the indexer database live there on Linux. Agents on endpoints hold keys and local logs.
Paths differ by install choice, with packages under var ossec and data under var lib. Version matters for restores, since schemas change. Never copy a live index while services run. Agent issues rarely need file hunts. Re enroll the agent to the new manager address, then check connectivity before assuming data loss. Check the in app storage readout when sizes look wrong on different releases.
Where Wazuh stores this, by platform
/var/ossec (manager config, indexer data beside it)
Manager config, rules, and agent keys live here. Indexer data sits beside it. Stop services before copying. Agents hold keys only. Match releases before restore.
Frequently asked questions
How do I migrate Wazuh to a new server?
Back up the Wazuh manager config plus indexer data snapshots with services stopped, then install the same release on the new server before restore. Agents re enroll to the new manager address. Mixed releases can refuse the restore, so match versions first.
Where is Wazuh alert history?
In OpenSearch Dashboards and server indices plus file logs beside the data directory. Agents hold keys and local logs only. Export alerts from the dashboard for archiving rather than copying agent folders. Treat the manager data directory as the backup target.
Notice an outdated path? Let us know.