Comment by Michele Dal Bosco (Michele) on "Setting Up Wazuh as Your SIEM on Debian 12 & Proxmox: A Step-by-Step Guide"

Hi, first of all congratulations on the guide; I have a problem following it; in my proxmox I made sure that the downloaded ISOs go to an NFS folder on my synology nas, while my proxmox is on a mini PC. Here I am going to put the various VMs and CTs on an LVM type disk, but here in the creation of the VM (following your guide) I noticed that in the part relating to the disks section, precisely in the area relating to the format, everything appears to me in gray not clickable and therefore I have no way to select the QEMU image format. How can I solve it? Thanks for your possible response.

Hey, it is not essential that you choose the same disk type. Debugging from afar is also hard but it could be that the underlying disk has the wrong format, is full or proxmox has no write access to the disk? If you can click the next button from the disk selection menu, that is fine and it should work even without the qemu format?

Maik Ro When I tried to get to that point I stopped; Maybe tomorrow morning I'll try to see if everything goes smoothly if I continue or if any problems appear. I don't think it's a full disk (according to Proxmox in the storage part relating to the disk in question it appears:

Activated: Yes Active: Yes Contents: Disk Image, Container Type: LVM Usage 66.11% (661.23 GB of 1.00 TB)

there on that disk I currently have 2 vm and 5 ct.

Michele Dal Bosco (Michele) ok let me know if it works out 🤞

Maik Ro Hi, it worked even without using the QEMU image format for the disk; could it be that maybe in that case it would have performed better? Now I have to understand why if in the agent (I tried the one for a Debian ct) during the installation phase, despite telling it which group to add and what name to give it, it seems that the command (WAZUH_AGENT_GROUP='SERVER' where server is the name of the group WAZUH_AGENT_NAME='AdGuard-debian' where in this case the name is AdGuard-debian) is ignored since it puts the agent in the default group (I created a couple of them, one for the servers and one for any client in lan), ditto for the name that takes for its own sake that of the hostname. Therefore it is up to (as far as the group is concerned) to issue the appropriate shell command on the "server" side of wazuh for each agent to be moved to the group and then the same to remove this agent from the default group.

Michele Dal Bosco (Michele) Unfortunately, we will not know if it would perform better without performance testing and I think that is out of scope for my home lab.

If possible I would encourage you to test it, but again not a mandatory experience.

I am glad you got it to work :) let me know how the rest of the journey is going!

Search Hashnode