Recommended Free Tools
The most practical Linux VPS intrusion-detection setup combines a Wazuh agent with a Wazuh manager, Linux Audit (auditd), and—when you need packet and protocol inspection—Suricata. The agent provides endpoint telemetry, auditd records system calls and privileged activity, and Suricata adds network-signature detection. Send all three streams to the manager, then verify them in Wazuh Threat Hunting before tuning rules and retention.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This layered design is more useful than choosing a single “best” IDS: host telemetry can explain what a process changed, while network telemetry can show how an attacker reached the service. The procedure below targets an Ubuntu or Debian-style VPS, with notes for other distributions supported by the manager.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat the finished design looks like
A VPS IDS has two distinct locations: the endpoint being monitored and the manager that stores, parses, and presents events. The endpoint runs the Wazuh agent. The manager can be a separate VPS, a protected server in the same private network, or a distributed installation for larger fleets.
What each layer detects
- Wazuh agent: collects endpoint telemetry and sends it to the manager through an encrypted, authenticated channel. Wazuh describes agents as lightweight software suitable for servers, cloud instances, containers, and virtual machines.
- Linux Audit (auditd): records selected system calls, file access, command execution, identity changes, and privileged actions. You decide which files, commands, and privilege transitions deserve rules.
- Suricata: inspects traffic visible on the VPS interface and emits structured events. It is an additional network IDS layer, not a replacement for host telemetry.
- Wazuh manager: receives, decodes, correlates, and displays the events. Suricata’s JSON event stream is ingested as a local file by the agent and then appears in Wazuh.
Event flow
The normal flow is VPS services and processes → auditd and Suricata logs → Wazuh agent → Wazuh manager → Threat Hunting and alerts. Keeping the manager separate means an intruder who compromises the application VPS has a harder time erasing the central record. A single-host installation is simpler for a small deployment; distributed managers and indexers provide more resilience as the fleet grows.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Plan the manager before touching the VPS
Choose a topology
For one or a few VPSs, an all-in-one Wazuh host is the least complicated arrangement. Put the manager on a machine with enough memory, CPU, and disk for indexing, and restrict management access to your administration network. For many endpoints or higher availability, split the central components across hosts and place them behind your normal backup and access controls.
Wazuh’s current server documentation lists Ubuntu 16.04, 18.04, 20.04, 22.04, and 24.04; Amazon Linux 2 and 2023; CentOS Stream 10; and RHEL 7 through 10 among supported systems. Confirm the exact support matrix for the release you intend to deploy, because an endpoint distribution and a manager distribution do not have to be identical.
Size CPU, memory, and disk
Use the following figures as planning baselines from Wazuh’s current documentation, not as a promise of a particular alert rate or retention period:
| Planning item | Published value | How to use it |
|---|---|---|
| Minimum manager size | 2 GB RAM, 2 CPU cores | Small proof-of-concept or very small endpoint count |
| Recommended manager size | 4 GB RAM, 8 CPU cores | More comfortable starting point for production workloads |
| Alert-volume planning example | 0.25 alerts per second per server endpoint | Wazuh sizing-table figure; actual volume depends on enabled rules and activity |
| 90-day event storage example | 0.1 GB per server endpoint | Wazuh sizing-table estimate; calculate additional space for your own logs and retention policy |
| Vulnerability database after unpacking | About 11 GB | Reserve this space before the manager’s first start |
| Free space recommended during first start | At least 20 GB | Leave headroom for unpacking and initialization |
The alert and storage numbers are estimates from a sizing table, not universal detection or retention guarantees. Suricata can materially increase event volume, especially when verbose protocol logging and broad rulesets are enabled. Monitor the manager’s index and filesystem usage from the first day.
Prepare connectivity and access
- Record the manager’s private or public address that the agent will use. The example below uses
10.0.0.2; substitute your real address. - Allow the Wazuh agent’s required communications between the VPS and manager in your cloud firewall and host firewall. Keep the manager’s administration interface off the public internet where possible.
- Ensure the VPS has enough free disk for audit logs, Suricata’s
eve.json, the agent’s queue, and any local log rotation. - Keep a console or out-of-band recovery path. A mistaken audit rule, packet-capture setting, or firewall change should not lock you out of the VPS.
Install and enroll the Wazuh agent
Install the agent on every Linux VPS you want to monitor. The manager itself is installed according to Wazuh’s server procedure; the commands below concern the endpoint agent.
- Add the signed Wazuh repository. Follow the Wazuh agent documentation for your distribution to install its repository signing key and repository definition. Do not replace the signed repository with an unverified package source.
- Install the package and set the manager address. On a Debian or Ubuntu endpoint, run the package command with the manager address as an environment variable:
sudo WAZUH_MANAGER='10.0.0.2' apt-get install wazuh-agentIf your package manager asks to resolve dependencies, accept the distribution’s normal updates before proceeding.
- Enable the service at boot and start it now.
sudo systemctl enable wazuh-agent sudo systemctl start wazuh-agent - Check the local service.
sudo systemctl status wazuh-agent sudo journalctl -u wazuh-agent --since '10 minutes ago'The service should be active without repeated connection or certificate errors. The manager should show the endpoint as connected after enrollment and initial synchronization.
- Confirm the endpoint identity. Give each VPS a clear name or group in the manager. Consistent names make it possible to distinguish an SSH event on a production host from the same source address on a test host.
Wazuh states that the agent communicates with its manager in near real time through an encrypted and authenticated channel. If the service starts but never appears centrally, troubleshoot routing, firewall policy, enrollment identity, and the manager address before adding more detection rules.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Enable Linux Audit telemetry with auditd
Auditd supplies the host-level detail that ordinary application logs often omit: which executable ran, which user or effective identity performed an action, and which protected file or system call was involved. Install it on the VPS, configure the agent to read the audit log, and then define rules for the activity that matters to you.
Install auditd
On Debian or Ubuntu:
sudo apt update
sudo apt install -y auditdUse the equivalent documented yum or dnf package command on an RPM-based endpoint. Start and enable the audit service using your distribution’s normal service manager, then confirm that /var/log/audit/audit.log is being written.
Tell the agent to read the audit log
Edit /var/ossec/etc/ossec.conf on the VPS and ensure it contains a local-file block for the audit format:
<localfile>
<log_format>audit</log_format>
<location>/var/log/audit/audit.log</location>
</localfile>Preserve any existing <localfile> entries. After saving the file, restart the agent:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo systemctl restart wazuh-agentDefine useful audit rules
Auditd is intentionally rule-driven. Use auditctl for immediate testing and the distribution’s persistent audit-rules file for rules that must survive a reboot. Start with a small, high-value set: identity and authorization files, changes to service definitions, execution of administrative tools, and privilege transitions relevant to the VPS role. A web server, database server, and bastion host should not all receive the same rule set.
Every rule should answer a question such as “Who changed this account file?” or “Which process executed this administrative command?” Give rules meaningful keys so that Wazuh searches and triage remain understandable. Broad syscall rules can create substantial volume; add them only when the investigative value justifies the CPU, disk, and alert cost.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Verify audit events in Wazuh
Perform one controlled action covered by a rule—for example, edit a test file in a monitored path—then check the Wazuh agent log for read errors and open Threat Hunting on the manager. Linux Audit alerts should be visible there. If the local audit log changes but no event arrives, check the XML spelling, file permissions, agent restart time, and whether auditd is writing to a different path on that distribution.
Add Suricata when network inspection is needed
Suricata is useful when you need protocol and signature context in addition to process and file telemetry: scans against exposed services, suspicious payloads, and other traffic patterns. It is optional for a host-only deployment. On many cloud VPSs, it can inspect traffic delivered to the instance’s own interface but cannot see traffic that never reaches that interface, such as traffic on a provider-managed network segment.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsInstall the engine and rules
On Ubuntu, Wazuh’s integration example uses the Open Information Security Foundation’s stable PPA and an Emerging Threats ruleset. The following is the corresponding installation pattern:
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update
sudo apt install -y suricata
sudo suricata-updateUse your distribution’s supported package source when a PPA is not appropriate. Keep the ruleset update process under change control; a new signature can change alert volume even when the VPS workload has not changed.
Set the network variables and interface
Edit /etc/suricata/suricata.yaml. Set HOME_NET to the VPS address or address range you intend to protect and set EXTERNAL_NET to any if you want the example’s broad external-network definition. In the af-packet section, replace the example interface with the VPS’s actual interface name.
Find that name instead of assuming it is eth0:
ip linkCloud images commonly use names such as ens3 or ens5. A wrong name prevents Suricata from opening the capture interface.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Start Suricata and connect its JSON log to Wazuh
- Restart Suricata after changing the YAML configuration and confirm that the service remains active.
- Open the agent configuration at
/var/ossec/etc/ossec.confand add a JSON local-file entry for Suricata’s event stream:<localfile> <log_format>json</log_format> <location>/var/log/suricata/eve.json</location> </localfile> - Restart the Wazuh agent so it begins reading the file:
sudo systemctl restart wazuh-agent - Generate or wait for a permitted test event and confirm that
/var/log/suricata/eve.jsonis receiving JSON records. Do not use destructive traffic or unauthorized scans as a test.
Wazuh automatically parses the eve.json stream and generates related dashboard alerts when the local-file entry is correct.
Prove that alerts are arriving
Use Threat Hunting filters
In the Wazuh interface, open Threat Hunting. Filter Suricata events with:
rule.groups:suricataLinux Audit alerts should also appear in Threat Hunting. Open an event and verify the endpoint name, timestamp, source or destination fields where applicable, decoder or rule information, and the original log details. A dashboard count by itself is not proof that the newest event is being ingested; inspect a recent record from the VPS you just changed.
Test each pipeline separately
- Agent pipeline: confirm the service is active and that ordinary endpoint logs arrive.
- Audit pipeline: perform one harmless action covered by a narrowly scoped audit rule and find its alert.
- Suricata pipeline: verify that
eve.jsonchanges, then locate the event with therule.groups:suricatafilter.
Testing separately prevents a successful agent connection from masking a broken audit or Suricata input. Record the test time in UTC and use it when searching the manager.
Detect SSH brute force and suspicious commands
For SSH, combine authentication logs collected by the agent with audit rules that capture privileged execution. Repeated failed logins, unusual source addresses, a successful login after a burst of failures, and a new privileged command are more meaningful together than any one event. Tune thresholds to the normal behavior of your VPS; automated scanners can otherwise dominate the alert stream.
For suspicious commands, audit the administrative paths and privilege transitions that matter to the host’s role, then retain the executable, user, effective identity, and command context in the event. Wazuh can correlate those audit records with other endpoint logs. Do not assume that a command name alone proves malicious intent: maintenance tools, deployment agents, and backup jobs often run with elevated privileges.
Choose host-only or host-plus-network coverage
| Implementation | What it covers | When it fits | Main trade-off |
|---|---|---|---|
| Wazuh agent plus auditd | Processes, files, identities, privilege actions, and operating-system logs | Most single VPSs, especially when CPU and disk are tight | Does not provide Suricata’s packet and protocol signatures |
| Wazuh agent, auditd, and Suricata | Host telemetry plus traffic visible on the VPS interface | Internet-facing services and investigations that need network context | More CPU, storage, rule maintenance, and alert tuning |
| Self-hosted single manager | Central control with one manager installation | Small deployments where simplicity matters | The manager is a central failure and capacity point |
| Self-hosted distributed manager | Central collection spread across components or hosts | Larger fleets or resilience requirements | More infrastructure and operational work |
| Wazuh Cloud | Hosted Wazuh management instead of operating every central component yourself | Teams that prefer a managed central service | Less direct control over infrastructure and sizing decisions |
There is no universal “better” choice between Wazuh and Suricata because they answer different questions. Wazuh is the host-monitoring foundation; Suricata is the network-inspection layer you add when its visibility is available and worth the operating cost.
Tune alert volume, storage, and rules
Start narrow, then expand
Begin with authentication, privilege, service configuration, and critical data paths. Watch the rate and usefulness of alerts for several normal operating cycles. Add broader syscall or network rules only when you can explain what decision each new event will support.
Control retention deliberately
Use the Wazuh sizing figures as a starting estimate, then measure your own index growth. Suricata’s event detail and rule count can change storage needs quickly. Configure rotation and retention so that a full filesystem cannot stop the manager or the monitored VPS. Keep a separate backup policy for events that must be retained beyond the online window.
Review rules after infrastructure changes
Changing a VPS image, interface name, exposed service, or deployment process can invalidate assumptions in both auditd and Suricata. Re-check monitored paths, the HOME_NET value, the af-packet interface, and the agent’s local-file entries after each such change.
Troubleshoot the common failure modes
The agent is active locally but absent in Wazuh
- Verify the manager address supplied during installation and in the agent configuration.
- Check routing and firewall rules in both directions required by your Wazuh deployment.
- Read
journalctl -u wazuh-agentfor enrollment, certificate, DNS, or connection errors. - Confirm that the manager itself is running and has capacity; a full disk or overloaded index can look like an endpoint problem.
Auditd is writing, but no Audit alerts appear
- Confirm the path is exactly
/var/log/audit/audit.logor change the local-file entry to the path your distribution uses. - Ensure the
log_formatvalue isaudit, not plain text or JSON. - Restart the agent after editing
ossec.confand look for XML or permission errors in its log. - Check that at least one audit rule actually matches the test action.
Suricata reports “Unable to find iface”
Run ip link, copy the real interface name, and update both /etc/default/suricata and the af-packet interface in /etc/suricata/suricata.yaml. Restart Suricata and check its service log. This error is normally an interface-name mismatch, not a Wazuh parsing problem.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →eve.json exists, but Suricata alerts do not appear
- Confirm the file is changing and that the agent user can read it.
- Check that the local-file block uses
jsonand the exact path/var/log/suricata/eve.json. - Restart the agent after the configuration change.
- Search Threat Hunting with
rule.groups:suricataand widen the time range to include the test.
The manager fills its disk
Inspect event growth, especially after enabling Suricata or a broad audit rule. Reduce unnecessary rule scope, review retention, and add capacity before the filesystem reaches exhaustion. Remember that Wazuh’s vulnerability database alone is about 11 GB after unpacking and that at least 20 GB free is recommended during first startup.
Operate the IDS safely
- Protect the manager as a security system: restrict administrative access, patch it through your normal change process, and back up its configuration.
- Keep agent and manager versions compatible with the supported documentation for your operating systems.
- Document every monitored path, audit key, Suricata interface, and alert-routing decision so another administrator can reproduce the setup.
- Review alerts during quiet periods as well as incidents. A pipeline that only works when someone is watching it is not a dependable detection system.
- Test after reboots and VPS image updates. Services can be installed correctly yet fail to start automatically if enablement, interface naming, or file paths changed.
With the agent reporting, auditd producing selected host events, and Suricata writing an ingested eve.json stream where appropriate, you have a defensible layered IDS for a Linux VPS. The final quality comes from validation and tuning: every alert should arrive at the manager, identify the correct endpoint, and provide enough context to support a decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
