Re: Prewikka not reporting agents or events

That's truly strange.  It will normally print something right around line
226 in your output, right after the Decoding Ethernet on interface blah
line.

I've only ever seen where it says it successfully authenticated or it spits
an error for a non-existent profile, permissions, or whatever the error is.
I'm not sure I've ever tried starting it when there was an issue with snort
not compiling with prelude or some sort of error on that side - but imagine
it would spit out an error indicating unknown or unsupported option.

Maybe someone else on the list will have an idea.

On Thu, Nov 20, 2008 at 10:46 AM, Jason Dixon <[email protected]> wrote:

> On Thu, Nov 20, 2008 at 10:44:11AM -0500, Jason Dixon wrote:
> > On Thu, Nov 20, 2008 at 10:19:06AM -0500, ScottO wrote:
> > > Okay, if you installed in the normal location /usr/local.  What does
> > > /usr/local/etc/prelude/default/client.conf have for server-addr= ?
> >
> > $ grep server-addr /usr/local/etc/prelude/default/client.conf
> > # server-addr = x.x.x.x:port || y.y.y.y && z.z.z.z
> > server-addr = 127.0.0.1
> >
> > > Also, if you start snort not in daemon mode, it should print to the
> screen
> > > either that it successfully connected to the prelude-manager, or the
> error.
> > > This is assuming you have the output prelude line referencing your
> > > registered profile in your snort.conf.
> >
> > Agreed, but it's not.  The output is pasted at
> > http://pastebin.com/f4e3da63e.
>
> Sorry, that should be:
>
> http://pastebin.com/f4e3da63e
>
> Stupid dot.  :)
>
>
> --
> Jason Dixon
> OmniTI Computer Consulting, Inc.
> [email protected]
> 443.325.1357 x.241
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user