Re: Prewikka not reporting agents or events
Jason Dixon <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Nov 20, 2008 at 11:23:29AM -0500, ScottO wrote:
> That's truly strange. It will normally print something right around line
> 226 in your output, right after the Decoding Ethernet on interface blah
> line.
Ok, I found the problem but I'm stuck on something else. The issue was
caused by /etc/sysconfig/snort, which had "-A fast" enabled. Apparently
this causes it to skip output plugins. I discovered this while trying
to get snort to log to database.
Now I'm running into permissions errors with the sensor. I've recreated
the profile but the analyzerid file is still owned root:root and I'm not
sure how to proceed.
...
Initializing Network Interface eth2
OpenPcap() device eth2 network lookup:
eth2: no IPv4 address assigned
Decoding Ethernet on interface eth2
ERROR: prelude-client: Unable to initialize prelude client: could not
open '/usr/local/etc/prelude/profile/snort/analyzerid' for reading
Profile 'snort' does not exist. In order to create it, please run:
prelude-admin register "snort" "idmef:w" <manager address> --uid 503
--gid 503.
Fatal Error, Quitting..
Thanks,
--
Jason Dixon
OmniTI Computer Consulting, Inc.
[email protected]
443.325.1357 x.241
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user