Re: [Prelude Universal SIM system] #291: prelude lml refuses to read a logfile

#291: prelude lml refuses to read a logfile
-------------------------+--------------------------------------------------
 Reporter:  anonymous    |        Owner:                    
     Type:  defect       |       Status:  closed            
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.14
Component:  prelude-lml  |      Version:  0.9               
 Severity:  normal       |   Resolution:  fixed             
 Keywords:               |  
-------------------------+--------------------------------------------------
Changes (by yoann):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 (In [11064]) Deprecate Gamin/FAM support in favor of libev. The previous
 implementation
 had problem on SELinux enabled system. This remove a lot of code working
 around FAM specific issue. Additionally, we use libev for monitoring the
 UDP server socket.

 The metadata format has changed, and we now use Gcrypt to generate a
 checksum,
 this provide a nice performance improvement by preventing the ftruncate()
 syscall prior saving metadata.

 When an user specify a file to be monitored that isn't available for
 reading,
 use libev to be notified of this file stat change anyway, until it can be
 monitored.

 Include 'original' file information in IDMEF generated alert for logfile
 modification.

 Make sure we use FILE_SERVER_METADATA_FLAGS_LAST when neither HEAD/TAIL
 metadata are specified (fix a bug with --metadata=nowrite).

 Rely on the kernel in place of our own function for checking file acces,
 this should fix #291.

-- 
Ticket URL: </ticket/291#comment:2>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel