event volume, number of active agents, enabled rules, inspection work and retention. Time the job and identify CPU, storage or external-service waits before replacing hardware.
Imports, processing and simultaneous users.Wazuh Hardware Requirements: RAM, CPU, Storage & Event Ingestion & Detection
Plan Wazuh RAM, CPU, persistent storage and service dependencies, with workload-based ZimaOS sizing, backups and practical hardware choices.
Wazuh hardware requirements at a glance
Wazuh supports security event collection, indexing and investigation dashboards. Size it around event volume, number of active agents, enabled rules, inspection work and retention, including the complete service stack and durable data. Collectors, analyzers, enforcement agents and indexers have distinct requirements. Event ingestion and retention can dominate the budget; secure host access must be deliberately configured.
- RAM
- 8 GiB for the documented 1โ25-agent all-in-one quickstart.
- CPU
- 4 vCPU for the same quickstart scope.
- Storage
- 50 GB for the small quickstart with 90-day alert indexing; include OS, additional data and backup headroom.
- Required services
- Follow the service topology in the linked upstream deployment for the chosen edition; include every required database, worker and storage service. The repository references Elasticsearch / OpenSearch. These may be integrations or alternative backends; install only the services required by your selected topology.
- Main sizing variable
- event volume, number of active agents, enabled rules, inspection work and retention.
- Practical Zima starting point
- ZimaBoard 2 1664 is an editorial small-stack candidate because the documented app/stack requirement leaves little or no OS headroom on an 8 GB shared host. Validate the complete deployment and its peaks.
From official requirements to the right setup
Plan the complete Wazuh workload before selecting a server.
-
Official requirements
Choose the exact edition, stable release and supported container/runtime. Follow the service topology in the linked upstream deployment for the chosen edition; include every required database, worker and storage service. The repository references Elasticsearch / OpenSearch. These may be integrations or alternative backends; install only the services required by your selected topology.
-
Confirm your needs
Test a representative busy operation: event volume, number of active agents, enabled rules, inspection work and retention. Record peak resident memory, CPU, disk latency and completion time, including other containers.
-
Leave room to grow
Place active state on reliable persistent storage. Persist security rules, enrolled-agent state, event indexes, retained logs and dashboard/configuration data. Budget working space for an upgrade or import and test recovery before relying on the deployment.
-
Run it on ZimaOS
On ZimaOS, use a compatible amd64 container through Custom Install and reproduce all required services, volume mappings and device access. The documented small all-in-one quickstart is 4 vCPU, 8 GiB RAM and 50 GB storage for 1โ25 agents with 90-day alert indexing. This is scope-limited guidance; the OS and co-hosted services need extra headroom.
Check every playback client
- Exact edition and stable release
- Compatible amd64 image/runtime
- All required companion services
- Realistic peak activity
- Persistent data and file ownership
- Free host ports and reachable URLs
- Working space and backup retention
- Successful database/file restore
Official minimum requirements
Reviewed October 30, 2026 against the linked upstream deployment documentation. Numerical values retain their stated minimum, recommendation or example scope; select release-compatible instructions before installation.
The documented small all-in-one quickstart is 4 vCPU, 8 GiB RAM and 50 GB storage for 1โ25 agents with 90-day alert indexing. This is scope-limited guidance; the OS and co-hosted services need extra headroom. Numerical examples above retain their stated deployment scope; co-hosted services and independent backups need additional capacity.
| Requirement | Official minimum | What this supports |
|---|---|---|
| RAM guidance | 8 GiB for the documented 1โ25-agent all-in-one quickstart. | Official guidance keeps its original test, recommendation or example scope. |
| CPU guidance | 4 vCPU for the same quickstart scope. | Core counts do not predict a fixed user, device or document capacity. |
| Storage planning | 50 GB for the small quickstart with 90-day alert indexing; include OS, additional data and backup headroom. | Installation space is separate from retained content, working files and backups. |
| Service topology | Follow the service topology in the linked upstream deployment for the chosen edition; include every required database, worker and storage service. The repository references Elasticsearch / OpenSearch. These may be integrations or alternative backends; install only the services required by your selected topology. | Include every stateful companion service in the host budget. |
| Persistent state | Persist security rules, enrolled-agent state, event indexes, retained logs and dashboard/configuration data. | An image rebuild or container replacement is not a backup. |
| Deployment boundary | The documented small all-in-one quickstart is 4 vCPU, 8 GiB RAM and 50 GB storage for 1โ25 agents with 90-day alert indexing. This is scope-limited guidance; the OS and co-hosted services need extra headroom. | Check the linked project instructions for the selected edition and release. |
When to upgrade your hardware
Use observed Wazuh workload pressure to decide when an upgrade is warranted.
Busy operations exceed the available window
The complete stack runs short of memory
Persistent data approaches available capacity
Inspect the application and each required service for OOM events, sustained swap or growing queues. Reduce unnecessary concurrency before adding capacity.
Shared hosts and background work.Persist security rules, enrolled-agent state, event indexes, retained logs and dashboard/configuration data. Track primary state and backup retention separately.
Long-lived installations and growing collections.Plan hardware growth with confidence
Address storage, memory, compute and deployment limits separately.
Use suitable active storage
Put latency-sensitive application/database state on durable local SSD storage and keep recoverable copies.
SATA or PCIe SSD according to measured data growth.Add memory for the complete stack
Choose a higher-RAM host when peak application and companion-service usage leaves inadequate OS headroom.
ZimaBoard 2 1664 or ZimaCube 2 Pro according to the measured constraint.Separate capacity from compute
A multi-drive system helps when retained content and backup storage are the problem; it is not automatically a faster application.
ZimaCube 2 when a broader multi-drive workload justifies it.Fix the observed bottleneck
The documented small all-in-one quickstart is 4 vCPU, 8 GiB RAM and 50 GB storage for 1โ25 agents with 90-day alert indexing. This is scope-limited guidance; the OS and co-hosted services need extra headroom.
Check service configuration, I/O and network behavior before selecting a stronger CPU.Can it run on ZimaOS?
Official one-click ZimaOS availability has not been certified for this guide. Use the supported upstream runtime and service topology; consider Custom Install only when a maintained compatible container and all required host capabilities are available.
Custom install Wazuh in ZimaOS
Follow the service topology in the linked upstream deployment for the chosen edition; include every required database, worker and storage service. The repository references Elasticsearch / OpenSearch. These may be integrations or alternative backends; install only the services required by your selected topology. Persist: Persist security rules, enrolled-agent state, event indexes, retained logs and dashboard/configuration data.
Custom install Wazuh in the ZimaOS app โUse the official Wazuh deployment instructions
Keep the selected stable release, persistent paths and companion services aligned with upstream documentation.
Review Wazuh official installation โCheck workload-specific deployment details
The documented small all-in-one quickstart is 4 vCPU, 8 GiB RAM and 50 GB storage for 1โ25 agents with 90-day alert indexing. This is scope-limited guidance; the OS and co-hosted services need extra headroom.
Review Wazuh deployment details โWhich Zima hardware fits Wazuh?
Start with the lowest reasonable host for the actual workload. Product specifications were checked against the current product pages.
Which workload best matches your Wazuh deployment?
Modest Wazuh deployment
Start with durable active data and a measured whole-stack memory budget.
- Workload optionZimaBoard 2 1664
Heavier jobs or more companion applications
Choose added memory or compute only when observed peaks justify the change.
- Workload optionZimaCube 2 Pro
These are practical workload recommendations, not official app requirements, compatibility certification, measured capacity limits or performance guarantees. Include all co-hosted services and independent backups.
| Zima hardware | Best for | Example workload | Core configuration | Recommended boundary | Next step |
|---|---|---|---|---|---|
| ZimaBoard 2 1664 | Modest Wazuh workload | event volume, number of active agents, enabled rules, inspection work and retention. |
|
This is an editorial host choice, not an official app minimum or a guaranteed user/device capacity. | Get Now |
| ZimaCube 2 Pro | More processing or shared-service headroom | Follow the service topology in the linked upstream deployment for the chosen edition; include every required database, worker and storage service. The repository references Elasticsearch / OpenSearch. These may be integrations or alternative backends; install only the services required by your selected topology. |
|
Size the combined stack and active working set; more RAM does not fix remote API limits or missing dependencies. | Get Now |
What the Press Says
Highlights from trusted reviewers worldwide.
โZimaCube 2: Not just another NAS, tested with 25TB storage, local AI agents, 4K transcoding, and real homelab workflows.โRead full review
โThe ZimaBoard 2 is a compact x86 server board that can be turned into a mini NAS, home server, media box, or self-hosting hub.โRead full review
โZimaCube 2: A modern, high-performance NAS with plenty of room to growโbuilt for users who want more than basic storage.โRead full review
โCoverage focused on ZimaCube 2's open hardware foundation, no monthly fee, and self-hosting flexibility.โRead full review
Loved by the Community
Stories and reviews from people who build with Zima every day.
โ
โ
โ
โ
โ
Zima Blade Little yet Powerful
Maybe I am not digital natives but I live with PCs since 12 years old in 1984 when IBM PC clone come to my home. Many years have passed and many operating system I've tried. For me Zima blade and CasaOS was a quantum leap for home PC enthusiast and server lab machine to make me stay curious and relevant for this era.
โ
โ
โ
โ
โ
Very good!!
I use ZimaCube Pro as 5th Proxmox cluster node. It runs several VMs and containers, including a VM with GPU passthrough to run a self-hosted LLM. A specific LXC container runs a Samba server for NAS capabilities using four of six RAID 6 SATA HDDs with ZFS.
โ
โ
โ
โ
โ
Great innovation for mini server!
It is very useful and makes a powerful mini server for many purposes, including university and college students in engineering and electronics. Thank you so much for making this server.
โ
โ
โ
โ
โ
Avaliaรงรฃo ZimaBoard 2
Construรญ um servidor de uso pessoal. O desempenho estรก muito bom e funciona perfeitamente onde quer que eu esteja. A surpresa รฉ nรฃo dependermos de grandes estruturas para termos nosso prรณprio servidor de dados. Como iniciante, estou gostando bastante do ZimaOS, pois ele รฉ simples e eficiente.
Frequently asked questions
Answers to Wazuh RAM, CPU, storage, Docker, database and ZimaOS sizing questions.
How much RAM should I plan for Wazuh?
8 GiB for the documented 1โ25-agent all-in-one quickstart. Include ZimaOS, the application and its companion services rather than reserving the entire machine for one container.
What drives the CPU requirement?
4 vCPU for the same quickstart scope. The workload to test is: event volume, number of active agents, enabled rules, inspection work and retention.
Which data must survive a container update?
Persist security rules, enrolled-agent state, event indexes, retained logs and dashboard/configuration data. Preserve a consistent database/file set and verify that your recovery procedure restores a working application.
What other services belong in the budget?
Follow the service topology in the linked upstream deployment for the chosen edition; include every required database, worker and storage service. The repository references Elasticsearch / OpenSearch. These may be integrations or alternative backends; install only the services required by your selected topology.
Does this workload need a dedicated GPU?
A dedicated GPU is not assumed for the core workflow described here. Optional AI, acceleration or media-processing integrations must be evaluated separately against the selected backend.
Can I deploy it on ZimaOS?
Use an amd64 container and the current upstream service topology through Custom Install when a suitable maintained image is available. Container availability alone is not a compatibility certification.
What should I check before upgrading hardware?
The documented small all-in-one quickstart is 4 vCPU, 8 GiB RAM and 50 GB storage for 1โ25 agents with 90-day alert indexing. This is scope-limited guidance; the OS and co-hosted services need extra headroom. Measure the same representative operation before and after a configuration or hardware change.
Which Zima device is a practical starting point?
ZimaBoard 2 1664 is the editorial starting point for this modest deployment. Choose ZimaCube 2 Pro for measured memory/processing pressure or broader shared services; retained data determines storage expansion.
What sources informed this Wazuh hardware guide?
This guide was reviewed against the linked project deployment documentation on October 30, 2026. Zima device choices are editorial workload guidance, separate from upstream requirements and measured performance.
