Wazuh Manager Keep-Alive Communication Through NATS

Published: at 11:53 AM

Table of contents

Open Table of contents

1. Primary Daemon: wazuh-remoted

The wazuh-remoted daemon is the core component responsible for agent communication and keep-alive management. It maintains persistent connections with agents and handles the bidirectional keep-alive mechanism using the handle_agent_connection() and wdb_update_agent_keepalive() functions.

Location: The remoted daemon operates under the wazuh user within the chroot environment at /var/ossec, managing all agent communication on port 1514/TCP by default.

2. Keep-Alive Storage - Database Layer

Main Database: Keep-alive timestamps and agent connection states are stored in /var/ossec/queue/db/global.db (SQLite database) within the agent table.

Key Tables:

3. Key Configuration Files

Manager Configuration: Keep-alive settings are configured in /var/ossec/etc/ossec.conf under the <remote> section:

<remote>
  <connection>secure</connection>
  <port>1514</port>
  <protocol>tcp</protocol>
  <manager_keepalive>
    <enabled>yes</enabled>
    <interval>60</interval>
    <timeout>180</timeout>
  </manager_keepalive>
</remote>

NATS Integration: XDR/OXDR platform connectivity configured in the <nats> section for real-time keep-alive event publishing.

4. Keep-Alive Mechanisms

Connection Status States: Manager tracks agents through multiple keep-alive states:

Status Verification Tools:

5. Source Code Structure

Based on the daemon architecture and functionality, the key source components for keep-alive management are located in:

Architecture Diagram

graph TB
    subgraph "Wazuh Manager"
        A[wazuh-remoted<br/>Port 1514] --> B[Keep-Alive Handler]
        B --> C[wazuh-db]
        C --> D[(global.db)]
        B --> E[NATS Publisher]
    end

    subgraph "Agents"
        F[Agent 001] -->|TCP/1514| A
        G[Agent 002] -->|TCP/1514| A
        H[Agent 003] -->|TCP/1514| A
    end

    subgraph "NATS Streaming"
        E --> I[agent.keepalive.*]
        I --> J[XDR Platform]
        I --> K[Monitoring Dashboard]
    end

    subgraph "Database Schema"
        D --> L[agent table<br/>- id<br/>- last_keepalive<br/>- connection_status<br/>- status_code]
    end

Agent Status Management Components

1. Primary Daemon: wazuh-remoted

The wazuh-remoted daemon is the core server-side component that manages agent communication and status. It handles the agent keepalive mechanism and updates agent status using the wdb_update_agent_keepalive(agent_id, AGENT_CS_ACTIVE, ...) function.

Location: The remoted daemon runs by default as the wazuh user and is chrooted to /var/ossec.

2. Agent Status Storage - Database Layer

Main Database: Agent status information is stored in /var/ossec/queue/db/global.db (SQLite database)

Individual Agent Databases: Each agent also has its own SQLite database at /var/ossec/queue/db/{AGENT_ID}.db for inventory and module-specific data. These contain tables like metadata, sync_info, scan_info, etc.

3. Key Configuration Files

Agent Keys: Agent authentication keys are stored in /var/ossec/etc/client.keys. When agents are removed, they can be marked as removed in this file or purged entirely based on configuration.

Connection Configuration: The manager’s connection service is configured in /var/ossec/etc/ossec.conf under the <remote> section, typically listening on port 1514/TCP for secure agent connections.

4. Agent Status Mechanisms

Connection Status: Agents report their status through multiple states:

Status Verification Tools:

5. Security Architecture Perspective

From a threat modeling standpoint (aligning with your XDR/OXDR focus), the agent status management involves several critical security components:

6. Source Code Structure

While I couldn’t directly access the v4.12.0 source tree, based on the error messages and daemon references, the key source components are likely in:

The agent status is primarily managed through the remoted daemon with persistent storage in SQLite databases under /var/ossec/queue/db/, providing both real-time connection tracking and historical agent state information for your security automation workflows.