Re: Problem with my snort sensor
Matt Kettler <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Pedro Sanchez Leyva wrote: > HI: > I have an snort sensor. When I try to run it in daemons mode de fallowing error appear . The sensor was created and registered. > > Mar 13 15:28:10 localhost snort[12588]: Daemon parent exiting > Mar 13 15:28:10 localhost snort[12632]: Daemon initialized, signaled parent pid: 12588 > Mar 13 15:28:10 localhost snort[12632]: FATAL ERROR: prelude-client: Unable to initialize prelude client: could not open '/etc/prelude/profile/snort/config' for reading: No such file or directory Profile 'snort' does not exist. In order to create it, please run: prelude-admin register "snort" "idmef:w" <manager address> --uid 502 --gid 502. Hmm, odds are snort is looking for /etc/prelude/profile/snort/config, but your registration tools created them somewhere else (ie: /usr/etc/prelude/, or /usr/local/etc/prelude). Check to see where the prelude snort config really is. From there, you'll probably have to re-configure and build snort, telling it where the prelude config is. However, I've got no idea how to do that Alternatively, you could create a symlink from the /usr/local/etc/prelude (or wherever) to /etc/prelude. _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user