Six months ago I deployed Wazuh across my homelab infrastructure — three servers, two VMs, a handful of containers. The pitch was solid: centralized security monitoring, threat detection, compliance checks, all open-source and free. Now that the novelty has worn off and I’ve dealt with the real operational weight of running it, here’s what a Wazuh self-hosted setup actually delivers.
What Wazuh Does Well
The core strength is genuine: log aggregation across heterogeneous infrastructure is genuinely difficult to wire up yourself, and Wazuh handles it. I have Ubuntu servers, a couple of Debian containers, a Windows box for reasons I don’t want to discuss, and Wazuh’s agent collects from all of them without complaint. The agents are small, the dashboard renders quickly on modest hardware, and the alerting rules are flexible enough that you’re not locked into someone else’s opinions about what matters.
The vulnerability scanning feature works. After deploying it, I found outdated packages on systems I thought were patched, CVE correlations I’d missed in manual scans. That alone saved me from at least one embarrassing oversight. The integration with public CVE databases updates automatically, and the reports are detailed enough to actually brief someone on without hand-waving.
File integrity monitoring caught a rogue script in my Jellyfin container before I would have noticed it. That’s the kind of moment that justifies running this stuff. Someone had compromised a dependency, FIM flagged the binary change, and I was able to isolate and rebuild before anything spread. Would I have caught it eventually? Maybe. Would I have caught it in time? Probably not.
Where the Shine Wore Off
The AI and anomaly detection features are underselling themselves. Wazuh advertises machine learning threat detection, and technically it delivers that. A behavioral baseline builds after a few weeks, and it flags deviations. The problem is the signal-to-noise ratio is terrible at first. For the first two months, I got alerts on legitimate traffic patterns that just weren’t common enough to establish a baseline. A Friday night backup job. A monthly certificate renewal. Once or twice, network configuration changes I’d made. All flagged as anomalous.
You have to tune it. There’s no magic knob that says “just be smarter.” I spent an evening writing custom rules to suppress the noise, which is fine — that’s part of self-hosting — but it contradicts the expectation that ML detection arrives pre-baked. It doesn’t. You’re doing the labor anyway; the ML just handles the math faster than you could manually.
The dashboard is functional but clunky. Wazuh doesn’t invest heavily in UX. It’s not offensively bad, but you notice when you’ve used Grafana or even the polished Datadog trial. Creating a custom dashboard involves clicking through nested menus and dragging panels around like you’re building a dashboard in 2015. The pre-built dashboards are thorough but sometimes too busy. I’ve actually gone back to Prometheus + Grafana for visualization in some cases, which feels wasteful.
Resource Requirements and Reality Check
Wazuh’s documentation says it can run on 2GB RAM and 2 cores. That’s technically accurate if you’re monitoring three systems with minimal logging. What it doesn’t say: Wazuh with Elasticsearch backend (which you need for anything beyond a toy deployment) will eat 4-6GB just for the stack on a real workload. I’m running it on a dedicated VM with 8GB and 4 cores, and I watch memory usage climb during high-volume log ingest periods.
The database grows aggressively. My instance captures about 200,000 events per day across all systems. Elasticsearch is storing roughly 30GB per month. I’ve had to set up index rotation and pruning policies to keep disk usage sane. That’s manageable but not free. You need attached storage or a VM with sufficient disk, not a Raspberry Pi in the corner.
Install complexity surprised me. The official Docker Compose setup works but isn’t minimal. It pulls multiple containers — Wazuh manager, Elasticsearch, Kibana, Nginx — and orchestrating those with proper persistence and networking takes more than one attempt if you’re doing it without copy-pasting their example. I ended up with a 150-line compose file and still had to troubleshoot certificate generation on first run.
Compliance and Audit Reporting
This is where Wazuh genuinely shines for larger setups. If you need to demonstrate PCI-DSS compliance or document security posture, the reporting features are thorough. Wazuh maps directly to CIS benchmarks, NIST frameworks, and compliance standards. I don’t have that obligation in my homelab, but I’ve generated sample reports and they’re presentable enough that you could send them to an auditor without embarrassment.
The compliance scanning catches configuration drift. Once I set a benchmark, Wazuh checks it regularly and alerts on deviations. A misconfigured sudo rule, a weak SSH setting, overpermissive file ownership — it catches those without needing a third tool. For a self-hosted environment, that’s valuable because it keeps you honest about your own infrastructure standards.
Integration Friction
Connecting Wazuh to the rest of your stack requires some glue. I wanted alerts in Slack. Wazuh has a Slack integration, but the setup involves webhook URLs, authentication tokens, and custom rule configurations. It works once you’ve threaded it through, but the documentation assumes you’ve done this before. I spent a solid hour on it because I expected it to be smoother than it is.
Integration with my existing Grafana dashboards was simpler via API calls, but that’s adding technical debt. I’m now querying Wazuh’s API from an external service to populate Grafana panels. It works, but it means I own the maintenance when Wazuh updates its API structure. That’s my choice to make that decision, but the path of least resistance (using Wazuh’s native dashboards) isn’t as compelling.
The Ongoing Maintenance Tax
Nothing here is one-and-done. Wazuh updates regularly, and Elasticsearch needs care. I’ve had to deal with index corruption once (user error — I manually deleted logs thinking I could do it safely), rebuilt the stack another time after a botched compose file edit. These aren’t catastrophic, but they’re ongoing. You’re responsible for backups, update testing, monitoring the monitor. For a hobbyist homelab, that’s a commitment.
Agent updates are straightforward but require discipline. Wazuh can push agent updates centrally, but I’ve still encountered situations where an agent gets stuck in a restart loop after an update. Not often enough to be a deal-breaker, but often enough that I check the dashboard after each agent version bump.
Security monitoring isn’t a set-it-and-forget-it feature. Even with automation, you’re watching logs that are watching your systems. There’s a feedback loop to maintain, rules to update, baselines to refine. If you’re expecting to deploy this and have it work invisibly, you’ll be disappointed. If you’re looking for a tool that gives you visibility and places the operational burden where it belongs (on you), Wazuh delivers that.
FAQ
Can Wazuh run on a Raspberry Pi?
The agent can; the manager cannot. A Pi can send logs to a central Wazuh instance, but the server component needs real hardware with at least 4GB RAM and stable storage. You could use a Pi as an edge agent collecting local logs, but that’s about it.
How much does Wazuh cost if I self-host it?
The open-source version is free. Wazuh also sells a cloud-hosted managed service and commercial support, but self-hosting costs nothing in licensing. You pay for infrastructure — compute, storage, and your time.
Is Wazuh better than Splunk or ELK for a homelab?
Splunk is expensive and overkill for hobbyist use. Raw ELK (Elasticsearch, Logstash, Kibana) gives you more flexibility but requires more configuration. Wazuh is a middle ground: pre-integrated, focused on security, and free. Choose based on whether you want a complete package or building blocks.
How long does it take to set up Wazuh from scratch?
The Docker Compose deployment takes 30 minutes if the documentation goes smoothly. Agent installation on each system takes 5-10 minutes per host. Getting the rules and alerts tuned to your environment takes several hours spread over a week or two as you learn what normal looks like for your infrastructure.
Does Wazuh’s AI detection actually work, or is it marketing?
It works but not automatically. The machine learning detects genuine anomalies once baselines are established, but it produces false positives initially and requires manual tuning. It’s a useful tool, not a magic box. Think of it as assisted threat detection, not autonomous.
Explore Wazuh in our AI Homelab Toolkit.