wazuh-documentation
wazuh-documentation copied to clipboard
Improve on instructions on how to install and uninstall the Wazuh macOS agent
Currently, instructions on how to install and uninstall a macOS agent include starting and stopping the Wazuh agent service through the utility wazuh-control
https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-macos.html
We could improve these steps recommending the use of a launchctl
command for this.
Update
(02/07/2024) Researching launchctl
usage and suitability for our case.
(03/07/2024) After deep research I have found that it's said in different sites that launchctl
should be used with the load
or unload
arguments.
Ref:
- https://apple.stackexchange.com/questions/29056/launchctl-difference-between-load-and-start-unload-and-stop
- https://discussions.apple.com/thread/5006946?sortBy=best
If we do so, the wazuh agent starts and stop by using load
and unload
, but the options start
, stop
and restart
do not work and using them do not start, stop or restart the wazuh agent service.
(04/07/2024) macOS lets you see the status of a service using launchctl print system/com.wazuh.agent
, but to do start or stop, if you do it with launchctl start system/com.wazuh.agent
does nothing, you have to remove thesystem/
.
The service can be managed with launchctl start com.wazuh.agent
and launchctl stop com.wazuh.agent
starting and stopping without any problem. Previously it is necessary to run launchctl load /Library/LaunchDaemons/com.wazuh.agent.plist
to load the service and be able to manage it.
The configuration file of the service, /Library/LaunchDaemons/com.wazuh.agent.plist
, adds a clause so that when it is loaded, it is launched, this is the root cause of this issue:
Not loading the service but having this clause was causing the agent to start automatically.
Regarding the documentation, if we want to manage the agent as a service we need to first run the launchctl load /Library/LaunchDaemons/com.wazuh.agent.plist
command and then start/stop or stop with launchctl start/stop com.wazuh.agent
. Restart cannot be used with launchctl
.
(08/07/2024) Updated PR with final solution. (10/07/2024) Updated PR with requested change.