Connexion problem between Snort and prelude-manager

Hi all,

we've encountered a problem when trying to make a snort sensor connect to a
remote Prelude-manager.
the error message we get is as follow (at the end of the initialization of
Snort):

Initializing Network Interface eth0
Decoding Ethernet on interface eth0
23 Apr 15:02:42 (process:12702) INFO: Connecting to 127.0.0.1:4690 prelude
Manager server.
23 Apr 15:02:42 (process:12702) WARNING: Failover enabled: connection error
with 127.0.0.1:4690: Connection refused


What we don't understand is the fact that the registration went well.
The command we used to register is : *prelude-admin register snort "idmef:w
admin:r" @prelude-manager --uid snort --gid snort*
the prelude manager received the request, we entered the command :
*prelude-admin
registration-server prelude-manager --passwd=<password>* and then entered
the password in snort, which said that he had registered well. (we also
tried without the --passwd option to have a generated password, but the
result remains the same)

We've found a similar case with Ossec when looking into the prelude mailing
list archive, (
http://lists.prelude-ids.org/pipermail/prelude-user/2008-March/002367.html )
where it was suggested to change the server-addr in the client.conf of
prelude. However, this parameter was already configured with the server
address, not 127.0.0.1.

The problem seems to come from the computer hosting snort, but I don't know
why it's doing this and where I can correct it.

Has anyone met this kind of problem with snort and prelude ? Any idea from
where it can come ?

Thanks in advance,

Sylvain
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user