Wazuh as a SIEM Tool: Log, Track, and Alert Every Linux Command Executed by Any User — A Hands-On Guide for Command-Level Security Audit

In modern security operations, visibility is everything. Every command executed on a Linux server could mean a configuration change, a failed attempt, or a potential intrusion. In this hands-on guide, we’ll explore how to use Wazuh, a powerful open-source SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) platform, to log every Linux command executed by any user, visualize the data, and trigger real-time alerts when suspicious activity occurs. Whether you’re a DevOps engineer, system administrator, or security analyst, this guide will help you strengthen your audit trails and build actionable security insights. In this step-by-step tutorial, we’ll put theory into practice through hands-on examples that you can apply in your own environment.

Topics we will cover:

**Introduction **

1. The Importance of Command-Level Auditing
2. What are Wazuh and SIEM? 2.1. Wazuh Architecture Overview

**Hands-On** 3. Installing the Wazuh 3.1. Requirements 3.2. Installing the Wazuh Central Components 3.3. Deploying Wazuh Agents on Linux endpoints 4. Log, Track, and Alert Every Linux Command 4.1. Linux Configuration 4.2. Wazuh Configuration 5. Checking Results in Wazuh Dashboard 6. Creating Alarm Rule (The Rule that generates an alarm for all commands) 7. Global Mail Notification Settings 8. Testing Whether the Alert Email Has Arrived 9. Troubleshooting 10. Clean up

11. Conclusion
12. Next post: “Next-Gen SIEM: Building an AI-Powered Linux Command Audit Pipeline using Wazuh, MCP Server, and OpenAI”
13. References

If you liked the article, I would be happy if you clicked on the clap 👏 button and the Medium Following button to encourage me to write and not miss future articles.

Your clapping 👏, following, or subscribing helps my articles reach a broader audience.

💙 Sharing this article with your network, so it reaches more people like you. Thank you in advance for your support.

For more info and questions, don’t hesitate to get in touch with me on **LinkedIn or [Medium](https://cmakkaya.medium.com/)**.

Introduction

1. The Importance of Command-Level Auditing

In most Linux environments, multiple users (system administrators, developers, or automation processes) execute commands daily. Without proper monitoring, a single unauthorized command can lead to system misconfigurations, privilege escalation, or data loss.

Command auditing is the backbone of accountability and security visibility. It allows you to:

🧾 Track every command executed on your servers.

🕵️ Detect suspicious or dangerous activity in real time.

🧩 Correlate user actions with security incidents or system changes.

Traditional Linux logging (e.g., bash_history) is limited — users can easily delete or manipulate it. That’s where Wazuh comes in. As a SIEM tool, it centralizes and protects these logs, providing dashboards, alerting rules, and automated responses when risky commands appear.

2. What are Wazuh and SIEM?

The Wazuh Dashboard.

Wazuh is a free and open source security platform that unifies SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh helps organizations and individuals to protect their data assets against security threats. (1)

Source: (14)

A comprehensive SIEM solution: SIEM is a security solution that helps organizations recognize and address potential security threats and vulnerabilities before they have a chance to disrupt business operations (2). The Wazuh SIEM solution provides monitoring, detection, and alerting of security events and incidents. This is a centralized platform for aggregating and analyzing telemetry in real time for threat detection and compliance. Wazuh collects event data from various sources, including endpoints, network devices, cloud workloads, and applications, to provide broader security coverage. (3)

Active XDR protection from modern threats: Wazuh provides analysts with real-time correlation and context. Active responses are granular, encompassing on-device remediation so endpoints are kept clean and operational. It provides a comprehensive security solution that detects, analyzes, and responds to threats across multiple IT infrastructure layers. Wazuh collects telemetry from endpoints, network devices, cloud workloads, third-party APIs, and other sources for unified security monitoring and protection. (4)

2.1. Wazuh Architecture Overview

The Wazuh architecture (5)

Wazuh is composed of the Wazuh agent and three central components: the Wazuh server, the Wazuh indexer, and the Wazuh dashboard.

Wazuh server

The Wazuh indexer is a highly scalable full-text search and analysis engine. It is responsible for indexing and storing alerts generated by the Wazuh server. It can be installed as a single-node or multi-node cluster, depending on the environment's needs.

Wazuh indexer

The server manages the agents, configuring and updating them remotely when necessary. This component analyzes data received from agents, processing it through decoders and rules and using threat intelligence to look for indicators of compromise.

Wazuh dashboard

A flexible and intuitive web interface for data mining, analysis, and visualization. The dashboard is used to manage the Wazuh configuration and monitor its status.

Wazuh agent

The Wazuh agent runs on Linux, Windows, macOS, Solaris, AIX, and other operating systems. It can be deployed to laptops, desktops, servers, cloud instances, containers, or virtual machines. The Wazuh agent helps to protect your system by providing threat prevention, detection, and response capabilities. It is also used to collect various types of system and application data, which it forwards to the Wazuh server through an encrypted and authenticated channel.

Required ports

Wazuh components communicate using several services. The list of default ports used by these services is shown below. Users can modify these port numbers when necessary.

Wazuh port numbers (6)

Hands-On

When managing production servers, one of the most important security practices is to monitor every command executed by users — especially those with elevated privileges.

While traditional audit solutions like auditd can be complex to configure, but you can achieve real-time command logging and alerting with Wazuh SIEM, using only rsyslog and a few configuration tweaks.

In this Hands-On, we’ll walk step-by-step through: ✅ Installing the Wazuh ✅ Logging all Linux shell commands from all users. ✅ Sending those logs to Wazuh. ✅ Creating custom decoders and rules to generate alerts when commands are executed. ✅ Creating Alarm Rule (rule that generates an alarm for all commands). ✅ Testing whether the alert email has arrived.

Let’s get started

3. Installing the Wazuh

3.1. Requirements

Hardware requirements highly depend on the number of protected endpoints and cloud workloads. This number can help estimate how much data will be analyzed and how many security alerts will be stored and indexed.

Hardware

The table below shows the recommended hardware for a deployment: (7)

Note-1: I successfully ran my system consisting of 5 agents on a VM with 2 CPUs and 4 GB RAM.

Note-2: For larger environments , Wazuh documentation recommends a distributed deployment. Multi-node cluster configuration is available for the Wazuh server and for the Wazuh indexer, providing high availability and load balancing.

Operating system

The Wazuh central components require a 64-bit Intel, AMD, or ARM Linux processor (x86_64/AMD64 or AARCH64/ARM64 architecture) to run. Wazuh recommends any of the following operating system versions:

• Amazon Linux 2, Amazon Linux 2023
• CentOS Stream 10
• Red Hat Enterprise Linux 7, 8, 9, 10
• Ubuntu 16.04, 18.04, 20.04, 22.04, 24.04

3.2. Installing the Wazuh central components

Download and run the Wazuh installation assistant:

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

Once the assistant finishes the installation, the output shows the access credentials and a message that confirms that the installation was successful. You have installed and configured Wazuh now.

Access the Wazuh web interface with https://<WAZUH_DASHBOARD_IP_ADDRESS> and your credentials:

Username: admin Password: <ADMIN_PASSWORD> For example: IZ4f*0VjRYgB.WSpmyBAeqJ8SNvwFz6*

When you access the Wazuh dashboard for the first time, the browser shows a warning message stating that the certificate was not issued by a trusted authority. This is expected, and the user has the option to accept the certificate as an exception or configure the system to use a certificate from a trusted authority.

After entering our username and password, we will see the opening page as shown below.

Note-1: Recommended Action: Disable Wazuh Updates. Wazuh documentation recommends disabling the Wazuh package repositories after installation to prevent accidental upgrades that could break the environment. Execute the following command to disable the Wazuh repository:

# APT (Debian/Ubuntu)
sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
apt update
# YUM
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

Note-2: You can find the passwords for all the Wazuh indexer and Wazuh API users in the wazuh-passwords.txt file inside wazuh-install-files.tar. To print them, run the following command:

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

3.3. Deploying Wazuh agents on Linux endpoints

Now that your Wazuh installation is ready, you can start deploying the Wazuh agent. (8)

Add the Wazuh repository

Add the Wazuh repository to download the official packages.

# Install the following packages if missing:

sudo su

apt-get install gnupg apt-transport-https

# Install the GPG key:

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

# Add the repository:

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

# Update the package information:

apt-get update

Deploy a Wazuh agent

WAZUH_MANAGER="10.0.0.70" apt-get install wazuh-agent

# Enable and start the Wazuh agent service:

systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent
systemctl status wazuh-agent

After the installation is finished, the Ubuntu VM where the Agent is installed will appear in the Wazuh Dashboard, as shown in the image below.

Note-1: To install a Wazuh agent on a different operating systems’ endpoints, visit this page.

Note-2: Disable Wazuh updates. Compatibility between the Wazuh agent and the Wazuh manager is guaranteed when the Wazuh manager version is later than or equal to that of the Wazuh agent. Therefore, we recommend disabling the Wazuh repository to prevent accidental upgrades. To do so, use the following command:

sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
apt-get update

4. Log, Track, and Alert Every Linux Command

4.1. Linux Configuration ⚙️

There are several ways to log all user commands to Wazuh. In this guide, we’ll use rsyslog, which is already included by default in most Linux distributions (Ubuntu, Debian, CentOS, Red Hat).

Step 1 — Add Logging Logic to Bash

Append the following line to the end of:

• /etc/bash.bashrc (for Ubuntu/Debian)
• /etc/bashrc (for Red Hat/CentOS)

export PROMPT_COMMAND='RETRN_VAL=$?;logger -t LinuxCommandsWazuh -p local6.debug "User $(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//")"'

This ensures every executed command is automatically sent to the local syslog service under the tag LinuxCommandsWazuh.

Step 2 — Create a Custom Rsyslog Config

Create a new file:

sudo nano /etc/rsyslog.d/bash.conf

Add the following line:

local6.* /var/log/commands.log

💬 This tells rsyslog to write all messages from the local6 facility to /var/log/commands.log.

Step 3 — Exclude Local6 from Default Syslog

Find this line inside /etc/rsyslog.d/50-default.conf:

*.*;auth,authpriv.none -/var/log/syslog

Replace it with:

*.*;auth,authpriv.none,local6.none -/var/log/syslog

🛠️ This prevents duplication of command logs in both /var/log/syslog and /var/log/commands.log.

Step 4 — Restart and Rotate Logs

Restart the rsyslog service:

sudo systemctl restart rsyslog

Then, ensure log rotation is configured for /var/log/commands.log inside

• /etc/logrotate.d/rsyslog (Ubuntu/Debian)
• /etc/logrotate.d/syslog (RedHat/CentOS)

Finally, log out and back in to apply the new configuration.

✅ You now have all executed commands logged to:

/var/log/commands.log

4.2. Wazuh Configuration ⚙️

Now it’s time to bring those logs into Wazuh for monitoring and alerting.

Step 1 — Configure the Wazuh Agent

Add the following snippet inside your agent configuration, ideally through a group configuration (e.g. linux-ubuntu):

<agent_config>
<localfile>
  <location>/var/log/commands.log</location>
  <log_format>syslog</log_format>
</localfile>
</agent_config>

This tells the Wazuh Agent to continuously read the /var/log/commands.log file.

Step 2 — Create Custom Decoders

Inside the Wazuh Manager, create or edit your decoder file (e.g. /var/ossec/etc/decoders/local_decoder.xml):

<decoder name="Linux-commands">
  <program_name>^LinuxCommandsWazuh</program_name>
</decoder>

<decoder name="Linux-commands1">
  <parent>Linux-commands</parent>
  <regex>User (\w+) [\d+]: (\.+)</regex>
  <order>User, Command</order>
</decoder>

These decoders capture the username and command executed from your syslog entries.

Decoders page in Wazuh:

Decoders page in Wazuh

Step 3 — Create a Custom Rule

In Wazuh VM, add a new rule in /var/ossec/etc/rules/local_rules.xml:

nano /var/ossec/etc/rules/local_rules.xml

<group name=”Linux-commands,”>
  <rule id="100002" level="3">
    <program_name>LinuxCommandsWazuh</program_name>
    <description>Command: “$(Command)” executed by $(User) in $(hostname)</description>
    <group>syslog, local</group>
  </rule>
</group>

💡 This rule triggers an alert each time a command is executed, showing the username, command, and hostname.

Rule page in Wazuh:

Rule page in Wazuh

5. Checking Results in Wazuh Dashboard

Once everything is configured, restart Wazuh, and then open your Wazuh Dashboard and search for the rule ID 100002 or search for the command you use in Linux Ubuntu, as shown in the image below;

You’ll see real-time alerts such as:

Command: "docker container ls" executed by root on prod-app-server

or

Command: "docker container ls" executed by cumhur.akkaya on prod-app-server

If you click on the magnifying glass, it will show the top 5:

6. Creating Alarm Rule (The Rule that generates an alarm for all commands)

You can then visualize these events, correlate suspicious activity, or even set up notifications via email, Slack, etc.

This rule captures any command coming from the decoder and generates an alarm. Open the /var/ossec/etc/rules/local_rules.xml file on your Wazuh Manager server and add the following rule: (9)

<group name="linux-commands,">
  <rule id="100050" level="5">
    <program_name>LinuxCommandsWazuh</program_name>
    <description>Command executed by $(User) on $(hostname): $(Command)</description>
    <group>syslog, local, audit</group>
    <options>alert_by_email</options>
  </rule>
</group>

The level=”5" value here is suitable for sending emails (exceeds the email threshold).

If you want, you can add a “High-risk command detection” section and create additional rules that will give different levels of alarm (level 10+) for commands such as rm -rf, systemctl stop, useradd.

For more information about the alarmanager installation, you can refer to this link: (10)

7. Global Mail Notification Settings

In Wazuh Manager, verify or add the following settings in the /var/ossec/etc/ossec.conf file:

<ossec_config>
  <global>
    <email_notification>yes</email_notification>
    <smtp_server>localhost</smtp_server> <!-- or relay server -->
    <email_from>wazuh@yourdomain.com</email_from>
    <email_to>you@yourdomain.com</email_to>
    <email_maxperhour>20</email_maxperhour>
  </global>

  <alerts>
    <email_alert_level>5</email_alert_level>
  </alerts>
</ossec_config>

Note-1: email_alert_level=5 → Email will be sent for all events at level 5 and above.

Note-2: smtp_server → If you are using an external server (e.g., Office365, Gmail), you need to install a Postfix relay. I use Gmail

Restart the Wazuh manager to load the updated rules and decoders:

systemctl restart wazuh-manager

8. Testing whether the alert email has arrived

Run a simple command on your Linux server (on the system where the Wazuh agent is installed):

A new alert in the Wazuh Dashboard saying “Command executed by…”

And you should receive a notification of this command in your email inbox within a minute.

9. Troubleshooting

View the Wazuh logs:

For Wazuh Agent and Wazuh Manager, run them in the VM where they are installed. To view in real time:

sudo tail -f /var/ossec/logs/ossec.log

Filter for a specific error or word:

sudo grep **ERROR **/var/ossec/logs/ossec.log

View the systemd logs with journalctl:

To view logs related to the Wazuh Manager service:

sudo journalctl -u wazuh-manager.service

To view in real time:

sudo journalctl -u wazuh-manager.service -f

From a specific date:

sudo journalctl -u wazuh-manager.service — since “2025–04–15 10:00”

View the wazuh-indexer log

sudo journalctl -u wazuh-indexer -n 50 — no-pager

To check the connection of the Wazuh-indexer’s port:

1. ping 172.16.3.60 (Can the server be reached)

2. ss -tuln | grep 9200 (Is port 9200 actually listening) wazuh-indexer is actually listening on port 9200, only on localhost (127.0.0.1), and there is no external access.

Check if certificates are installed: sudo ls -l /etc/wazuh-indexer/certs/-

Certificates are installed.

10. Clean up

Uninstalling the Wazuh agent

Remove the Wazuh agent installation. Run the following command If you want to remove all files completely: (12)

apt-get remove --purge wazuh-agent

Disable the Wazuh agent service:

systemctl disable wazuh-agent
systemctl daemon-reload

Uninstalling the Wazuh central components

Follow these steps to uninstall the Wazuh central components using the Wazuh installation assistant (13):

Download the Wazuh installation assistant:

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh

Run the Wazuh installation assistant with the option -u or --uninstall as follows:

bash wazuh-install.sh --uninstall

This will remove the Wazuh indexer, the Wazuh server, and the Wazuh dashboard.

🎯 11. Conclusion

We learned and implemented how to combine rsyslog with Wazuh SIEM, you can easily track every command executed across your Linux infrastructure — without needing complex agents or kernel-level auditing tools.

This setup provides: ✅ Full visibility into user activity ✅ Compliance-ready audit trails ✅ Real-time alerts for suspicious commands

If you liked the article, I would be happy if you clicked on the clap 👏 button and the Medium Following button to encourage me to write and not miss future articles.

Your clapping 👏, following, or subscribing helps my articles reach a broader audience.

💙 Sharing this article with your network, so it reaches more people like you. Thank you in advance for your support.

For more info and questions, don’t hesitate to get in touch with me on **LinkedIn or [Medium](https://cmakkaya.medium.com/)**.

📬 12. Next post

Next post: “Next-Gen SIEM: Building an AI-Powered Linux Command Audit Pipeline using Wazuh, MCP Server, and OpenAI”

We’ll integrate Wazuh command logs with an MCP Server to analyze user activity through AI-driven. Thanks to the MCP Server (Model Context Protocol), we will create this pipeline as follows:

➡️ Linux → Wazuh Agent → MCP Server (custom handler) → LLM / AI Model → Alert & Insight

We will do these practically, step by step, in the next articles. Stay tuned!

Happy Clouding…

I hope you enjoyed reading this article. Don’t forget to follow **my LinkedIn or [Medium](https://cmakkaya.medium.com/) **account to be informed about new articles.

🔗13. References

(1) https://documentation.wazuh.com/current/getting-started/index.html (2)https://www.ibm.com/think/topics/siem#:~:text=Security%20information%20and%20event%20management%2C%20or%20SIEM%2C%20is%20a%20security,chance%20to%20disrupt%20business%20operations (3) https://wazuh.com/platform/siem/ (4) https://wazuh.com/platform/xdr/ (5) https://documentation.wazuh.com/current/getting-started/architecture.html (6) https://documentation.wazuh.com/current/getting-started/architecture.html#required-ports (7) https://documentation.wazuh.com/current/quickstart.html (8) https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html (9) https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rule-options.html#alert-by-email (10) https://documentation.wazuh.com/current/user-manual/manager/alert-management.html (11) Rsyslog Official Documentation (12) https://documentation.wazuh.com/current/installation-guide/uninstalling-wazuh/agent.html#uninstalling-the-wazuh-agent (13) https://documentation.wazuh.com/current/installation-guide/uninstalling-wazuh/central-components.html#uninstalling-the-wazuh-central-components (14) https://www.bitlyft.com/resources/is-elastic-stack-elk-the-best-siem-tool