Asked for six months of logs and could not find them: what Wazuh is and when you need it

An email arrives from a large customer, or an auditor, or your own board: we need the access logs for the last six months. You open the server and find a log that starts last week — because the machine overwrites its oldest entries when the file fills, and it has been doing that for years without telling anyone.

This is the moment most people discover they have protection but no memory.

The difference between blocking and knowing

The firewall blocks. The antivirus stops the malicious file. Both work, and both record what they saw — each in its own console. So when something happens you have three windows that do not talk to each other, and a question none of them answers alone: is what the firewall stopped at the edge the same thing that appeared on the accounting machine an hour later?

That third layer — the one that collects, reads and joins — is called a SIEM. Wazuh is an open source platform that does it, with no licence to buy and no cap on machines.

What it actually sees

Not generalities. These are the things that show up on the dashboard in the first week at almost any company:

• Repeated failed logins against RDP or SSH — one address against dozens of accounts, or dozens of addresses against one. This is how most of what hits a small company gets in.
• A new account on the domain that was not created by whoever should have created it.
• A file changed on the accounting server — with who changed it and when.
• A service stopped or disabled, which is the first thing ransomware does: switch off the backup.
• Machines carrying known vulnerabilities and unpatched for months, by name rather than by guess.

And what it does not do

It watches; it does not block. It stops no file, closes no port, and replaces neither the firewall, nor endpoint protection, nor the backup. Anyone selling it to you as a substitute for those is selling you an illusion.

Free — and that is half the truth

The platform genuinely is open source with no licence. The real cost is three things, and whoever does not tell you will not hand you something that works:

• A server of its own. Its size is set by two things: how many machines, and how long you want the logs kept. The retention is what eats the disk, because logs accumulate every day and never shrink.
• The tuning time. This is the largest item, and the next section is about it.
• Somebody to read it. A dashboard nobody opens is not monitoring; it is a server drawing electricity.

Why the tuning is the whole job

Straight after installation Wazuh raises a great many alerts, and most of them do not concern you: a service that restarts nightly on a schedule, a sync that opens a connection at the same time each day, a user mistyping a password on the morning they come back from leave. Anyone who leaves the defaults opens the dashboard for three days and then never again.

The real work is teaching the platform what is normal on your network: which service opens which port, who signs into what and when, which file changes are part of the day's work and which are not. Only what falls outside that raises an alert. This is not a step in the installation; it is the installation.

And who reads the alerts afterwards?

A more important question than any of the above, and it has no technical answer. If you have a technical team, the dashboard is handed to them and they are trained on it. If you do not — which is most mid-sized companies — the realistic option is a support contract under which we read it and tell you what is worth knowing. The third option, the worst and the most common, is that it gets installed and nobody reads it at all.

Does it suit a small company?

It suits one that has something worth recording: a server holding data that matters, an obligation to a customer or a regulator, or accountability for personal data. It does not suit a company whose whole estate is five machines and a router — that needs a good backup and endpoint protection, not a monitoring dashboard.

The practical rule: if the server going down stops the work, you deserve to know what is happening on it.

ZEMAVO Technology installs the platform, deploys the agents, tunes the rules and hands you a dashboard you can read yourself — the service is here, and here is a project where we brought FortiGate, Sophos and Kaspersky logs into one dashboard.