[Prelude Hybrid IDS] #248: prelude-manager crash
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#248: prelude-manager crash ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: new Priority: high | Milestone: Component: prelude-manager | Version: 0.9 Severity: critical | Keywords: ---------------------------------+------------------------------------------ running the prelude-manager with aproximitly 400 lml agents i get this message in syslog {{{ prelude-manager: idmef-message-scheduler.c:init_file_output:573: couldn't open /var/spool/prelude/prelude-manager/mid-priority-fifo.146 in append mode: Too many open files. }}} shortly after that if im lucky the prelude-manager stops reporting but is still running and the lmls start crashing with messages like {{{ prelude-lml: prelude-client: error starting prelude-client: TLS handshake failed: A TLS packet with unexpected length was received.. In order to register this sensor, please run: prelude-adduser register prelude-lml "idmef:w" hostnamehere --uid 0 --gid 0 Profile 'prelude-lml' does not exist. In order to create it, please run: prelude-adduser register prelude-lml "idmef:w" <manager address> --uid 0 --gid 0. }}} If im not lucky the box running the lml becomes inaccessable via ssh or concole until it is rebooted. I suspect that this might be solved be increasing fs.file-max in /etc/sysctrl however this is still untested. if it works a note should be added to the installation instructions about large installs. I will provide more debuging information as I find it but this should be looked into -- Ticket URL: <https://trac.prelude-ids.org/ticket/248> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel