| Newsgroups |
gmane.comp.security.ids.prelude.user |
| Message-ID |
<[email protected]> |
BigDaddy schrieb:
> Yoann Vandoorselaere schrieb:
>
>> Le jeudi 21 février 2008 à 16:17 +0100, [email protected] a écrit :
>>
>>
>>>> However, if this happen at each rotation, without you restarting LML,
>>>> then it look like a failure to properly detect the rotation.
>>>>
>>>> If this is the case, please provide information about the way your logs
>>>> are rotated (and the software doing it), and tell us whether LML is
>>>> using the FAM backend.
>>>>
>>>>
>>> ok, that's new .... every time logs are rotated (every 6 hours) i
>>> didn't restart lml ... now i'm trying that variant.
>>> hope this will solve the problem ;)
>>>
>>>
>> I was not suggesting to restart LML upon log rotation, I was asking
>> whether you did that. You shouldn't have to restart LML.
>>
>>
>>
>>> thanks for your help.
>>> would be great if there might be another way to solve this problem by
>>> NOT restarting lml ever 6 hours, when i rotate logs.
>>>
>>> btw. i think i use FAM.
>>> since i followed your tutorial when installing prelude a while ago i'm
>>> pretty sure i compiled prelude-lml with fam support.
>>>
>>>
>> Could you please try to deactivate FAM support and tell me whether the
>> problem reproduce?
>>
>>
>>
> ok, so now i deactivated the FAM support but the problem keeps
> reproducing regularly.
>
> but i discovered that when i restart lml every time logs are rotated no
> "logfile inconsistency" is sent out by the sensor.
>
> thanks,
> david
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://www.prelude-ids.org/mailman/listinfo/prelude-user
hi again,
ok, it's seems like i ran prelude-lml all along without FAM support on
our freebsd servers - sorry for that mis-information. now i tested on
three servers recompiling prelude-lml NOW WITH FAM-SUPPORT .... but
still i receive : "logfile inconsistency" alerts every time logfiles are
rotatetd by the system.
something interesting i noticed: these "logfile inconsisteny" alerts
produce only on servers with very little logfile activitiy, meaning
sometimes the /var/log/messages contains only the two messages that the
logfile is being rotated and nothing else and then a "logfile
inconsistency" alert is produced.
maybe this is possible hint in order to support me solving this problem.
thanks (especially yoann).
ciao
david
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user