Re: Prewikka not reporting agents or events
Yoann Vandoorselaere <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Le jeudi 20 novembre 2008 à 17:03 -0500, Jason Dixon a écrit : > On Thu, Nov 20, 2008 at 11:23:29AM -0500, ScottO wrote: > > That's truly strange. It will normally print something right around line > > 226 in your output, right after the Decoding Ethernet on interface blah > > line. > > Ok, I found the problem but I'm stuck on something else. The issue was > caused by /etc/sysconfig/snort, which had "-A fast" enabled. Apparently > this causes it to skip output plugins. I discovered this while trying > to get snort to log to database. > > Now I'm running into permissions errors with the sensor. I've recreated > the profile but the analyzerid file is still owned root:root and I'm not > sure how to proceed. You might want to use the 'prelude-admin chown' command along with --uid and --gid option to reset the whole profile permission to the user/group you want to use. Regards, -- Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies Tel: +33 (0)9 50 70 21 58 Fax: +33(0)9 57 25 21 58 http://www.prelude-ids.com _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user