remote sensor limit
Steve Williamson <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
I have 11 remote sensors and all of of them regularly check in and show active status in Prewikka. Except for the 11th one that checks in. It eventually shows missing. and never returns. A check at the sensor shows all programs running and working fine. (Prelude-manager, prelude-lml and snort. Some even have OSSEC) I removed all alerts, and heartbeats. Then I stopped all remote sensors and restarted them in a different order. The 11th one to check in eventually shows missing, and never returns. I checked to see if they were sending out heartbeats via a ngrep packet capture and the packets did arrive on the receiving prelude- manager network. Also all times on the machines are synced via ntp. I checked and they are the same. Any ideas why this is happening? --- Prelude Manager 0.9.14.1, Prelude LML 0.9.12.2, Snort 2.8.2.2, Ossec v1.5.1 -- Steve _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user