Install AgentX Client on Debian Linux

Install AgentX Client on Debian Linux endpoints to enable log collection and monitoring.

Prerequisites

• Ubuntu 22.04, 20.04, or 18.04 (x86_64 architecture)

• Root or sudo access

• AgentX Client installer (tar.gz file) downloaded from Release Notes

• IP address of Logpoint where AgentX Server and AgentX Manager are installed

• Network access to Logpoint on ports 1514 and 1515

Procedure

1. Open a terminal.

2. Navigate to the directory containing the downloaded AgentX Client file.

3. Extract the installer:

tar -xvf AgentX_Client_debian.tar.gz

1. Run the installation script:

sudo ./install.sh

1. When prompted, enter the Logpoint IP address where AgentX Server and AgentX Manager are installed.

2. When prompted to install osquery, enter y to enable osquery or n to skip.

The terminal displays "Successfully installed AgentX" when the installation completes.

Install with custom osquery configuration

To install with a custom osquery configuration file:

./install.sh MANAGER_ADDRESS=XX.XX.XX.XX OSQUERY_INSTALL=Y CUSTOM_OSQUERY_CONF=/path/to/osquery.conf VALIDATE_CONF=Y

Replace /path/to/osquery.conf with the path to your custom configuration file.

Install with custom SSL certificates

To install with custom SSL certificates:

./install.sh MANAGER_ADDRESS=XX.XX.XX.XX OSQUERY_INSTALL=y SSL_CERT=/path/to/cert.cert SSL_KEY=/path/to/cert.key

Expected outcome

• AgentX Client (OSSEC) installs in /opt/logpoint/ossec

• osquery installs in /opt/logpoint/osquery (if enabled)

• The wazuh-agent service starts automatically

• The agent connects to Logpoint and appears in Settings > Configuration > AgentX > Agents

Verification

1. Verify the wazuh-agent service is running:

systemctl status wazuh-agent

1. Go to Settings > Configuration in Logpoint and select AgentX.

2. Select Agents.

3. Verify that your endpoint appears in the agents list.

If the endpoint does not appear, verify:

• Network connectivity to Logpoint on ports 1514 and 1515

• The wazuh-agent service is running

• The correct Logpoint IP address was entered during installation

Change Logpoint IP address after installation

If you need to change the Logpoint IP address after installation:

1. Edit the OSSEC configuration file:

sudo nano /opt/logpoint/ossec/etc/ossec.conf

1. Locate the <address> tag and update it with the new Logpoint IP address.

2. Save the file and exit the editor.

3. Restart the wazuh-agent service:

sudo systemctl restart wazuh-agent

Next steps

• Configure AgentX in device

• Access Linux logs