Requirements

What a server needs before you run the install command. The install command checks most of this itself and stops with a list of what failed; fix the items and run the same command again.

Operating system

The install command supports these and only these:

Distribution	Versions
Ubuntu	22.04, 24.04
Debian	12
Red Hat Enterprise Linux, Rocky Linux, AlmaLinux	9.x

• x86-64 (amd64) only. The Wazuh core images are built for amd64. ARM servers (arm64, for example AWS Graviton or Ampere) are refused: architecture aarch64: Theseus needs x86_64 (amd64).
• systemd must be running.
• A clean server is best. The install command refuses a stack directory that already holds a different installation.

Use Ubuntu 24.04 LTS when you have the choice.

Sizing

The install command enforces the minimum memory for each server's role. The other figures are our recommendations: Wazuh's indexer (OpenSearch) is the largest consumer of memory and disk, and its needs grow with the number of endpoints and how long you keep alerts.

Topology	Server	Memory (enforced minimum)	Recommended CPU / memory	Recommended disk
One server	all services	8 GB	8 vCPU / 16 GB	100 GB SSD or more
Two servers	core (Wazuh)	6 GB	8 vCPU / 16 GB	100 GB SSD or more
Two servers	app (consoles)	4 GB	4 vCPU / 8 GB	40 GB SSD

• Memory check. The command accepts 90% of the figure, because a machine sold as "8 GB" reports slightly less.
• Disk check. At least 40 GB must be free on the file system that holds the stack directory (/opt/theseus by default). That is the floor for the software; alert data comes on top. Size the core's disk for your alert retention (45 days by default; see Data retention).
• Indexer memory. The indexer's Java heap is INDEXER_HEAP, 1 GB by default. Set it to about half the memory you want the indexer to use, for example 4g on a 16 GB single server. Ask your provider to change it, or see Change configuration.
• Agents. CPU and disk scale with the number of endpoints and the volume of their events. Start with the recommendation and watch Platform health.

Kernel settings

Setting	Value	Who sets it
vm.max_map_count	at least 262144	The install command, on all and core servers, persisted in /etc/sysctl.d/99-theseus.conf

The Wazuh indexer does not start below this value. On a host where the command cannot change it (some containers and restricted VMs) the check fails; set it on the host itself.

Time

The clock must be synchronised. Signed requests between the stack, the agents and the control plane are refused when clocks differ by more than a few minutes. The install command enables NTP if it is off and waits up to 60 seconds for synchronisation; if it still is not synchronised, install chrony or systemd-timesyncd and run timedatectl set-ntp true.

Docker

You do not need to install Docker. If Docker Engine 24 or later is present, it is kept; otherwise the install command installs Docker Engine and the Compose plugin from Docker's official repository (download.docker.com) and enables the service.

On RHEL-family servers, the podman, buildah and runc packages conflict with Docker's packages; remove them first.

Ports that must be free

The install command checks that nothing else listens on the ports the server's role needs:

Role	Ports that must be free
all (one server)	443, 80, 1514, 1515
core	1514, 1515
app	443, 80

Stop any existing web server (Apache, nginx) or Wazuh installation first. Which ports to open in your firewall is a separate question: see Network and firewall.

Access you need

• root (or sudo) on the server.
• Outbound HTTPS from the server to the Theseus control plane and registry (the address is in the install command), and to download.docker.com if Docker is not installed. The full list is in Network and firewall.
• A DNS name for the console, if you want one (recommended). See DNS and TLS.

Checklist

• [ ] Supported OS, x86-64, systemd running
• [ ] Memory and disk as above
• [ ] Clock synchronised
• [ ] Ports free
• [ ] Outbound HTTPS allowed to the control plane
• [ ] DNS name chosen (optional)
• [ ] The install command from us (valid for 24 hours, usable once)