Master.conf vs worker.conf

[chadlangston]

Do the master.conf and worker.conf files always need to be identical? For instance, does the Slack integration need to be added to both the master.conf and worker.conf?

[crlsgms]

not really, if you setup a cluster the master will be the master, and the worker will be the worker. also there are some other configurations that you can tailor, for example setting up another worker outside the kubernetes cluster, and instead of poiting up to the 1516 on the master you can use a nodeport and etc

[chadlangston]

Thanks for the tip! Do you know if my Slack integration need to be in both the master and the worker? Is there any documentation on how the master and workers are set up and configured that would help me understand the differences?

[crlsgms]

I don't use the slack integration to know specifics, but I believe the worker just forwards everything to the master, and on my installations I set alerting only on the master node, but using a cluster as they have to be set who is who, the configuration file in its integrity is not replaced.

also , the alerts architecture as I understand is like this:

• worker fetches data
• master gather and forwards via filebeat to indexer (opensearch)
• if the trigger is matched, the indexer send the alert

https://documentation.wazuh.com/current/user-manual/manager/index.html

[chadlangston]

Thank you!