Table of contents
What is SIEM and why does your server need it?Choosing the right SIEM tool for your setupSIEM prerequisites on your dedicated serverStep-by-step: Installing a SIEM solution (Wazuh) on your serverIntegrating SIEM with other tools and log sourcesConfiguring alerts and monitoring rulesPerformance tips for running SIEM on a dedicated serverNext stepsAdditional resources
Get the industry’s best dedicated server hosting◦ 99.999% uptime
◦ Security rich
◦ Built to spec
Explore options

Dedicated Server → Configure SIEM

How to configure SIEM (Security Information and Event Management) on your dedicated server

Your server might look quiet on the surface, but what’s happening in the logs tells a very different story. Hidden threats, brute-force attempts, and subtle misconfigurations can slip by unnoticed—unless you’ve got the right eyes on everything. That’s where SIEM comes in.

Explore dedicated servers
Build now

What is SIEM and why does your server need it?

SIEM (Security Information and Event Management) is a centralized solution for collecting, analyzing, and responding to log data from across your server infrastructure. It combines real-time monitoring with historical data analysis to detect threats, maintain compliance, and support forensic investigations.

For dedicated servers, SIEM fills a critical gap in visibility. It helps:

  • Detect brute force attacks and unauthorized access
  • Monitor system integrity and file changes
  • Identify malicious behavior in logs
  • Provide evidence for incident response
  • Meet compliance requirements like HIPAA, PCI-DSS, and GDPR

Choosing the right SIEM tool for your setup

You don’t need to go full enterprise to benefit from SIEM. Here’s a breakdown of options:

Open source options:

  • Wazuh – Full-featured fork of OSSEC with a modern dashboard
  • OSSEC – Lightweight host-based IDS with log analysis
  • Security Onion – Powerful suite with Suricata, Zeek, and ELK
  • Snort + ELK Stack – Network IDS with visualization via Elasticsearch and Kibana

Commercial tools:

  • Splunk – Enterprise-grade, resource-intensive, highly scalable
  • LevelBlue USM – Unified threat management + SIEM
  • IBM QRadar – Best for large enterprises with dedicated teams

Stick with Wazuh or OSSEC if you’re running a single dedicated server. They’re resource-conscious and highly capable.

SIEM prerequisites on your dedicated server

Before you install anything, make sure your server is ready:

  • A modern Linux distro: Ubuntu 20.04+, CentOS 7+, AlmaLinux/Rocky
  • At least 2 CPU cores, 4GB RAM (8GB+ for dashboard features)
  • 50GB+ of free disk space
  • SSH access with sudo privileges
  • Firewall configured (e.g., ufw or firewalld)
  • Log sources enabled: /var/log/auth.log, /var/log/syslog, /var/log/secure, etc.

Step-by-step: Installing a SIEM solution (Wazuh) on your server

Let’s walk through setting up Wazuh, which includes log analysis, a web dashboard, and rule-based alerting.

1. Install dependencies and update your server

sudo apt update && sudo apt upgrade -y
sudo apt install curl apt-transport-https lsb-release gnupg -y

2. Add Wazuh repository and install the manager

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg –dearmor -o /usr/share/keyrings/wazuh.gpg

echo “deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main” | \
  sudo tee /etc/apt/sources.list.d/wazuh.list

sudo apt update
sudo apt install wazuh-manager -y

3. Start and enable Wazuh manager

sudo systemctl daemon-reexec
sudo systemctl enable –now wazuh-manage

4. Install and configure the Wazuh agent (optional on same server)

sudo apt install wazuh-agent -y
sudo nano /var/ossec/etc/ossec.conf
# Set <address> to your Wazuh manager’s IP if running agent separately
sudo systemctl enable –now wazuh-agent

5. Set up the Wazuh dashboard (via OpenSearch Dashboards)

Wazuh ships with its own dashboard. Quick setup:

curl -sO https://packages.wazuh.com/4.6/wazuh-install.sh
sudo bash wazuh-install.sh -a

This installs the full Wazuh stack with OpenSearch and dashboards.

Integrating SIEM with other tools and log sources

Once installed, expand your SIEM coverage:

  • Add Apache/Nginx logs by editing /var/ossec/etc/ossec.conf
  • Use Filebeat to ship logs from other services like MySQL or custom apps
  • Integrate UFW, iptables, or csf firewall logs
  • Set up syslog forwarding from remote servers or devices

Example for Apache logs:

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/apache2/access.log</location>
</localfile>

Configuring alerts and monitoring rules

Wazuh includes a rule-based engine that supports email, Slack, or custom webhook alerts.

Steps:

  1. Edit ossec.conf to set up notification commands
  2. Modify rule levels in /var/ossec/etc/rules/local_rules.xml
  3. Use logtest utility to simulate and test your rules
  4. Avoid noise: suppress or fine-tune frequent benign alerts

Example Slack alert integration via webhook:

  • Use Wazuh’s active-response module
  • Write a script to POST to Slack’s webhook URL
  • Trigger it on level 10+ alerts

Performance tips for running SIEM on a dedicated server

SIEM can eat resources fast if not tuned. Keep it lean:

  • Rotate logs using logrotate
  • Limit retention to 30–90 days depending on use case
  • Move archived logs to a separate disk or storage mount
  • Disable unnecessary modules in ossec.conf
  • Offload dashboards to a separate VPS if RAM-constrained

Additional resources

What is a dedicated server? →

Benefits, use cases, and how to get started

Is renting or buying a dedicated server better for your business? →

Explore the pros and cons of renting vs. buying a dedicated server to make the best decision for your business.

Fully managed dedicated hosting →

What it means and what fully managed services cover on dedicated hosting

After studying Mechanical Engineering at Lawrence Technological University, Jeff Goudie earned a Computer Science degree at Eastern Michigan University. He began his career as a mainframe operator, unaware that the tiny IBM XT personal computers he was installing would take off and revolutionize the way we live. Eventually, he was hired directly at Chrysler to support their lab equipment, computers, and dynamometers, a tech journey that led him to Liquid Web.