Re: prewikka agents page refresh feature
ScottO <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
LC, I have a little perl script that I put in cron, and have it check every 15 or 30 minutes for offline sensors, emails me if they are. Not that having it in the Prewikka view wouldn't be valuable, just that I like to know right away if something has gone offline. It's available here: http://ribwich.bitparser.com, as "Offline Prelude Sensor Script" You just need to change the username/password/dbname near the top, and put an email address in at the bottom in place of the sample one that is there. It isn't perfect, but it works. Basically builds a list of known sensors, and sees if heartbeats haven't been coming from them. Hope that might help you, Scott On Fri, Apr 18, 2008 at 8:06 AM, Yoann Vandoorselaere < [email protected]> wrote: > Le jeudi 17 avril 2008 à 10:54 -0700, LC Bruzenak a écrit : > > On the prewikka agents page there is no refresh feature as is on the > > "heartbeats" or "events" pages. > > This is an extremely nice feature; any chance it could be added? > > I agree it would be a nice feature to have: do not hesitate to open a > ticket for that one. > > > Also - IIUC the clients are sending keepalive probes as defined in the > > /etc/prelude/default/client.conf file. > > So, the values in the keepalive section must be adequate from the client > > side or the server will not show the right status regardless of the > refresh > > rate, right? > > That's correct: if your client advertise a 600 seconds keepalive, but > does not respect that interval, you might see the sensor as Missing > under Prewikka. > > Additionally, it is important for all machine with Prelude module to be > NTP synchronized. > > -- > Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies > Tel: +33 (0)8 70 70 21 58 Fax: +33(0)4 78 42 21 58 > http://www.prelude-ids.com > > _______________________________________________ > Prelude-user site list > [email protected] > http://lists.prelude-ids.org/mailman/listinfo/prelude-user > _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user