How Much RAM Do You Need for Wazuh?

Practical Wazuh sizing guidance for small labs, test environments and growing deployments.

Wazuh sizing depends on how many agents send data, event volume, retention, enabled integrations and whether the indexer, manager and dashboard share the same machine. RAM shortages usually show up first in the indexer layer.

Small lab

For a learning environment with a handful of agents, 8 GB RAM is a practical starting point for an all-in-one deployment. Very small test installs may run with less, but memory pressure can make indexing and dashboards frustrating.

When 16 GB makes sense

Move toward 16 GB when retaining more data, running vulnerability detection, collecting noisy Windows logs or adding integrations. Storage growth can become just as important as memory.

Do not size by agent count alone

Two environments with 50 agents can generate very different event volumes. Measure events per second, daily index growth and peak heap usage before scaling production infrastructure.