Syscollector

The Syscollector module collects system inventory information from Wazuh agents and detects changes in system state over time.

Overview

Syscollector performs periodic scans to gather inventory data and only sends changes to the Wazuh manager, providing efficient monitoring of system state across your infrastructure.

Key Features

• Comprehensive Inventory: Collects hardware, OS, packages, network, processes, users, services, and browser extensions
• Change Detection: Only reports modifications, not full inventory
• Cross-Platform: Supports Windows, Linux, macOS, and Unix systems
• Configurable: Flexible scan intervals and component selection
• Local Storage: SQLite database for change detection and state persistence

How It Works

1. Periodic Scanning: Collects current system inventory based on configured interval
2. Change Detection: Compares with previous scan stored in local SQLite database
3. Delta Events: Generates events only for changes (additions, modifications, deletions)
4. Event Transmission: Sends inventory events to manager for processing and indexing

Inventory Categories

Quick Start

Basic Configuration

Add to your agent's ossec.conf:

<wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>

    <!-- Enable inventory categories -->
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports>yes</ports>
    <processes>yes</processes>
    <users>yes</users>
    <groups>yes</groups>
    <services>yes</services>
    <browser_extensions>yes</browser_extensions>
    <hotfixes>yes</hotfixes> <!-- Windows only -->
</wodle>

Verify Operation

Check that syscollector is running:

grep syscollector /var/ossec/logs/ossec.log

Documentation