Re: remote sensor limit
Yoann Vandoorselaere <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hello Steve, Le mardi 09 septembre 2008 à 14:06 -0500, Steve Williamson a écrit : > I have 11 remote sensors and all of of them regularly check in and > show active status in Prewikka. Except for the 11th one that checks > in. It eventually shows missing. and never returns. A check at the > sensor shows all programs running and working fine. (Prelude-manager, > prelude-lml and snort. Some even have OSSEC) > > I removed all alerts, and heartbeats. Then I stopped all remote > sensors and restarted them in a different order. The 11th one to > check in eventually shows missing, and never returns. > > I checked to see if they were sending out heartbeats via a ngrep > packet capture and the packets did arrive on the receiving prelude- > manager network. Could you enable the prelude-manager 'debug' plugin, and make sure heartbeat of the 11th agent are printed? Additionally, can you confirm the issue happen randomly, independently of the type of sensor? -- Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies Tel: +33 (0)8 70 70 21 58 Fax: +33(0)4 78 42 21 58 http://www.prelude-ids.com _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user