Re: Prewikka not reporting agents or events
Jason Dixon <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Nov 20, 2008 at 10:19:06AM -0500, ScottO wrote: > Okay, if you installed in the normal location /usr/local. What does > /usr/local/etc/prelude/default/client.conf have for server-addr= ? $ grep server-addr /usr/local/etc/prelude/default/client.conf # server-addr = x.x.x.x:port || y.y.y.y && z.z.z.z server-addr = 127.0.0.1 > Also, if you start snort not in daemon mode, it should print to the screen > either that it successfully connected to the prelude-manager, or the error. > This is assuming you have the output prelude line referencing your > registered profile in your snort.conf. Agreed, but it's not. The output is pasted at http://pastebin.com/f4e3da63e. And regarding the configuration: $ grep prelude /etc/snort/snort.conf # prelude: log to the Prelude Hybrid IDS system # output alert_prelude output alert_prelude: profile=snort Thanks, -- Jason Dixon OmniTI Computer Consulting, Inc. [email protected] 443.325.1357 x.241 _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user