Uptime Kuma vs Wazuh: In-Depth Comparison and Setup Guide for Self-Hosted Monitoring and SIEM on a $5 VPS

Why Self‑Hosted Monitoring & SIEM on a $5 VPS Still Makes Sense#

You might think a $5 virtual private server (VPS) is too cheap for serious monitoring or security analytics. In practice, a modest VPS with 1 vCPU, 1 GB RAM and a 25 GB SSD can run lightweight services just fine—if you pick tools that respect the resource envelope.

• Cost transparency – No hidden fees, you know exactly what you’re paying each month.
• Full control – You decide which ports are exposed, how data is stored, and which updates you apply.
• Learning value – Setting up and tuning the stack yourself teaches you the inner workings of monitoring (Uptime Kuma) and SIEM (Wazuh).

In this post we’ll compare two popular self‑hosted projects, walk through a complete Docker‑based installation on a $5 VPS, and give you a decision checklist so you can pick the right tool for your environment.

Quick Recap of the Two Projects#

What Is Uptime Kuma?#

Uptime Kuma is an open‑source, easy‑to‑use monitoring dashboard written in Node.js. Think of it as a self‑hosted “Uptime Robot” with a modern UI, flexible notification channels, and support for HTTP, TCP, ICMP, DNS, and more. It stores its data in SQLite by default, which means a tiny disk footprint.

Key points:

• Monitors: HTTP(s), TCP/UDP, ping, DNS, Docker, Kubernetes, and custom scripts.
• Alerting: Email, Slack, Discord, Telegram, Gotify, and webhook integrations.
• UI: Responsive, single‑page React app that can be accessed from any browser.
• Deployment: Docker, Docker‑Compose, or binary installation.

What Is Wazuh?#

Wazuh is a security‑focused platform that started as an OSSEC fork and has grown into a full‑blown SIEM. It collects logs, performs file integrity monitoring (FIM), runs vulnerability detection, and correlates events across agents. The server component includes an Elasticsearch (or OpenSearch) backend and a Kibana‑style dashboard.

Key points:

• Log collection: Syslog, Windows Event Log, cloud logs, containers, etc.
• Threat detection: Rule‑based alerts, MITRE ATT&CK mapping, vulnerability scanning.
• Scalability: Designed for many agents; on a tiny VPS you’ll run a single‑node deployment.
• Deployment: Official Docker‑Compose stack (Wazuh manager, Elasticsearch, Kibana) or Ansible scripts.

Feature Comparison Table#

Architecture & Resource Footprint on a $5 VPS#

A $5 VPS typically offers 1 vCPU, 1 GB RAM, and 25 GB SSD. Uptime Kuma fits comfortably with room to spare. Wazuh can run, but you must trim Elasticsearch (disable replicas, lower refresh interval) and keep the data volume low (e.g., 7‑day retention). The guide below shows the minimal configuration that stays within the limits.

Setting Up Uptime Kuma on a $5 VPS#

Prerequisites#

1. A fresh Ubuntu 22.04 VPS with a non‑root user that has sudo rights.
2. Docker Engine 20.10+ and Docker‑Compose 2.0+.
3. Port 3001 (default for Kuma) open in your firewall.

# Update packages
sudo apt update && sudo apt upgrade -y

# Install Docker
sudo apt install -y ca-certificates curl gnupg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

# Add your user to the docker group (log out/in after)
sudo usermod -aG docker $USER

Docker‑Compose File#

Create a folder uptime-kuma and add docker-compose.yml:

version: "3.8"
services:
  kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    restart: unless-stopped
    ports:
      - "3001:3001"
    volumes:
      - ./data:/app/data
    environment:
      - TZ=UTC

Run it:

cd uptime-kuma
docker compose up -d

Visit http://your-vps-ip:3001 and finish the initial admin setup (username/password). The UI will guide you through adding monitors: HTTP checks, ping, Docker container health, etc.

Tips to Keep RAM Low#

• Set MAX_MONITORS=50 in the environment if you plan to exceed 50 checks.
• Disable the built‑in “ping” history retention (pingHistoryDays=7).
• Use the “Read Only” mode for Docker containers you only need to view, not poll.

Setting Up Wazuh on a $5 VPS#

Prerequisites#

Same as above, but we’ll also need curl for the installation script. Wazuh’s official Docker‑Compose defines four services: manager, Elasticsearch, Kibana, and Filebeat (optional). We’ll trim it down.

# Install Docker (if not already done)
# ... same steps as before ...

# Verify Docker works
docker run --rm hello-world

Minimal Docker‑Compose for Wazuh#

Create a folder wazuh and a docker-compose.yml:

version: "3.8"
services:
  wazuh:
    image: wazuh/wazuh:latest
    container_name: wazuh-manager
    restart: unless-stopped
    ports:
      - "55000:55000"   # API
      - "1514:1514/udp" # Syslog (agents)
    environment:
      - ELASTICSEARCH_HOST=elasticsearch
      - ELASTICSEARCH_PORT=9200
      - WAZUH_API_USER=admin
      - WAZUH_API_PASSWORD=SuperSecret123
      - TZ=UTC
    depends_on:
      - elasticsearch

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.10
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms256m -Xmx256m   # Keep RAM low
      - bootstrap.memory_lock=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
    volumes:
      - esdata:/usr/share/elasticsearch/data

  kibana:
    image: docker.elastic.co/kibana/kibana:7.17.10
    container_name: kibana
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch

volumes:
  esdata:

Why these settings?

• ES_JAVA_OPTS=-Xms256m -Xmx256m caps Elasticsearch RAM at 256 MB, which is the sweet spot for a 1 GB VPS.
• discovery.type=single-node removes cluster overhead.
• We expose only the API (55000) and the UDP syslog port (1514) for agents.

Start the stack:

cd wazuh
docker compose up -d

Give Elasticsearch a minute to become ready, then open http://your-vps-ip:5601. The default credentials are admin / admin. Change the password immediately.

Adding an Agent (Linux)#

On the same VPS (or another host) install the agent:

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo apt-key add -
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt update
sudo apt install wazuh-agent -y

# Configure the manager IP (replace with your VPS IP)
sudo sed -i 's/^MANAGER_IP=.*/MANAGER_IP=YOUR_VPS_IP/' /var/ossec/etc/ossec.conf

# Register the agent (run on manager)
docker exec -it wazuh-manager /usr/bin/wazuh-control register-agent -n my-vps

# Start the agent
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

After a few seconds the agent appears in the Wazuh dashboard under Agents → Manage.

Keeping Disk Usage Low#

• Set logstash_output.elasticsearch.index_pattern="wazuh-alerts-7days" in kibana.yml (or via UI) to keep only a week of data.
• Use the built‑in log rotation (/var/ossec/logs/) – default is 7 days.
• Periodically purge old indices:

curl -XDELETE "http://localhost:9200/wazuh-alerts-*/?pretty"

Real‑World Use Cases: Monitoring vs SIEM#

In practice many teams run both: Kuma for quick service health dashboards, Wazuh for deep security analytics. On a $5 VPS you can host both, but you’ll need to stagger checks (e.g., run Wazuh at night) or upgrade to a $10 plan for comfort.

Pros & Cons Side by Side#

Checklist: Which Tool Fits Your $5 VPS Use Case?#

If you tick more boxes under Uptime Kuma, go with it. If security visibility is the priority and you can live with tighter resource limits, Wazuh is the way forward.

Frequently Asked Questions#

1. Can I run both Uptime Kuma and Wazuh on the same $5 VPS?
Yes, but you must keep Elasticsearch memory low (-Xms256m -Xmx256m) and limit data retention to a few days. Expect total RAM usage around 900 MB, leaving ~100 MB for the OS.

2. Do I need a domain name for Uptime Kuma alerts?
No. Alerts can be sent to raw webhook URLs, email SMTP servers, or messaging apps using API tokens. A domain is only useful if you want a friendly URL for the dashboard.

3. How do I back up my Wazuh data?
Mount a host directory for the Elasticsearch volume (esdata:) and periodically copy it with rsync or a snapshot script. For the manager’s configuration, back up /var/ossec/etc/ from the container.

4. What is the best way to secure the Wazuh API?
Expose the API only on localhost (127.0.0.1:55000) and place a reverse proxy (NGINX) in front with basic auth or client‑certificate auth. Never leave the API open to the internet without additional protection.

5. Can I replace Elasticsearch with OpenSearch to reduce resource usage?
Yes. Wazuh officially supports OpenSearch. The Docker image opensearchproject/opensearch:2.x can be swapped in the compose file, and Kibana becomes OpenSearch Dashboards. Memory requirements are similar, but you may find a lighter configuration in newer releases.

Conclusion#

Self‑hosting monitoring and SIEM on a $5 VPS forces you to be disciplined about resource usage, but it also gives you unparalleled insight into how the tools work under the hood. Uptime Kuma shines as a lightweight, plug‑and‑play status board, while Wazuh brings enterprise‑grade security analytics to the same modest hardware—provided you trim Elasticsearch and keep data windows short.

Pick the tool that aligns with your immediate goals, start with the step‑by‑step Docker setup above, and iterate. As your environment grows, you can migrate to a larger VPS or a managed cloud service without having to relearn the fundamentals.

Happy monitoring, and stay secure. For more hands‑on guides, visit mahbuburriad.com.