Re: [Prelude Universal SIM system] #313: Configuration PRELUDE-LML WITH PRELUDE-MANAGER

#313: Configuration PRELUDE-LML WITH PRELUDE-MANAGER
-----------------------------------+----------------------------------------
 Reporter:  [email protected]  |        Owner:                    
     Type:  task                   |       Status:  closed            
 Priority:  normal                 |    Milestone:  Prelude-LML 0.9.14
Component:  prelude-lml            |      Version:  0.9               
 Severity:  normal                 |   Resolution:  invalid           
 Keywords:                         |  
-----------------------------------+----------------------------------------
Changes (by yoann):

  * status:  new => closed
  * resolution:  => invalid


Comment:

 Replying to [ticket:313 alvareco1@…]:
 > I want send the events to Prelude Manager by SYSLOG PORT 514 UDP.

 Prelude-Manager read event through a specialized Prelude protocol, but
 it's not related to the Syslog protocol. However, Prelude-LML can receive
 Syslog messages (using the udp-server option), and send alert to Prelude-
 Manager.

 > When I uncomment the line udp-server and add the IP Console an restart
 the service prelude-lml (/etc/init.d/prelude-lml stop)    (/etc/init.d
 /prelude-lml start)
 >
 > {{{
 > [format=metalog]
 > prefix-regex = "^(?P<timestamp>.{15}) \[(?P<program>\S+)\] "
 > time-format = "%b %d %H:%M:%S"
 > file = /var/log/everything/current
 > udp-server = x.x.x.x
 > }}}
 >
 > OR
 >
 > include = /etc/prelude/default/idmef-client.conf
 >
 >
 > # Address where the Prelude Manager Server is listening on.
 > # if value is "127.0.0.1", the connection will occur throught
 > # an UNIX socket.
 > #
 > # This entry is disabled. The default is to use the entry
 > # located in the Prelude system wide clients.conf. You may
 > # overwrite the default address for this sensor by uncommenting
 > # this entry.
 > #
 > server-addr = x.x.x.x
 >
 > This show the following message error:
 > {{{
 > udp_server_new:199: couldn´t bind to socket: Cannot assign requested
 address
 > }}}

 This error most probably happen because you already have a syslog server
 listening on this host. Either use LML to receive UDP Syslog (with no
 additional Syslog UDP server listening), or configure LML to read files
 generated by the Syslog server receiving remote messages.

 Since this is a configuration issue, I am marking this bug as invalid.
 Please direct further question concerning this problem to the prelude-user
 mailing list.

 Regards,

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/313#comment:2>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel