This article details a method for monitoring critical system resources—CPU, memory, and disk space—on a server hosting the Wazuh manager service. By leveraging a custom bash script and Wazuh's built-in capabilities, administrators can proactively detect and alert on potential system health issues.

System Resource Monitoring Script

A bash script, metric.sh, was developed to collect system resource utilization. This script identifies the server's IP address, current memory consumption, disk space usage for the root partition, and CPU utilization.

The script's core functionalities include:

• Host Identification: It determines the IP address associated with the network interface that has a route to 8.8.8.8. Alternatively, a hostname can be used.
• Memory Usage: It captures the percentage of consumed memory using a command like free -mh. For instance, a value of 68.73 indicates that 68.73% of the allocated memory is in use.
• Disk Space Usage: It reports the percentage of disk space used on the root partition, as shown by df -sh. The script is designed to target the root partition but can be modified to monitor other mount points, such as NFS shares, if logs are written elsewhere.
• CPU Utilization: It measures the current CPU usage. In a low-activity environment with one Wazuh agent and minimal Elasticsearch load, CPU usage might appear low, such as 0.08.

The collected data is then formatted into a JSON string with fields for host, ram, cpu, and disk. This JSON output is written to /tmp/health.json.

Integrating with Wazuh Manager

To ensure continuous monitoring, the metric.sh script is configured to run every 30 seconds directly by the Wazuh manager. This is achieved by adding a configuration block to the Wazuh manager's configuration file.

The configuration specifies:

• Tag: metric
• Command: /var/ossec/bin/wazuh-execd /opt/metric.sh (assuming the script is placed in /opt/)
• Interval: 30s (seconds)
• Run on start: yes

The output of the script is directed to the /tmp/health.json file, and the Wazuh manager is configured to collect this file as a JSON source. This allows Wazuh to parse the resource metrics.

Detection Rules and Alerts

Custom detection rules are created within Wazuh to trigger alerts when resource utilization crosses predefined thresholds. These rules are designed to parse the JSON data from /tmp/health.json.

Key rule configurations include:

• Log Format: Explicitly set to JSON.
• Grouping Rule: A rule with signature_id 1000014 is used to group all metric health check events. This rule checks for the existence of the cpu field, acting as a wildcard for metric collection logs.
• Conditional Alerts: Based on the grouped metric events, specific conditions are evaluated:
  • Memory Usage: Alerts are triggered if the ram field starts with 8 (80-89%), 9 (90-99%), or equals 100. The alert message is "Memory usage is high," followed by the actual consumed value.
  • CPU Utilization: Alerts are triggered if the cpu field starts with 8 (80-89%), 9 (90-99%), or equals 100. The alert message is "CPU usage is high," followed by the current CPU utilization.
  • Disk Space: Alerts are triggered if the disk field starts with 7 (70-79%), 8 (80-89%), 9 (90-99%), or equals 100. The alert message is "Disk space is running low," followed by the current disk usage percentage.

These alerts are assigned a severity level of 12, indicating a higher priority. The system can then route these alerts to appropriate channels such as Slack or PagerDuty for timely resolution.

This approach enables Wazuh to monitor not only its own processes but also the underlying server infrastructure, providing a comprehensive view of system health.