Re: Prewikka not reporting agents or events
Jason Dixon <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Nov 21, 2008 at 01:02:34PM +0100, Yoann Vandoorselaere wrote:
> Le jeudi 20 novembre 2008 ?? 17:03 -0500, Jason Dixon a ??crit :
> > On Thu, Nov 20, 2008 at 11:23:29AM -0500, ScottO wrote:
> > > That's truly strange. It will normally print something right around line
> > > 226 in your output, right after the Decoding Ethernet on interface blah
> > > line.
> >
> > Ok, I found the problem but I'm stuck on something else. The issue was
> > caused by /etc/sysconfig/snort, which had "-A fast" enabled. Apparently
> > this causes it to skip output plugins. I discovered this while trying
> > to get snort to log to database.
> >
> > Now I'm running into permissions errors with the sensor. I've recreated
> > the profile but the analyzerid file is still owned root:root and I'm not
> > sure how to proceed.
>
> You might want to use the 'prelude-admin chown' command along with --uid
> and --gid option to reset the whole profile permission to the user/group
> you want to use.
That did it! :)
Initializing Network Interface eth2
OpenPcap() device eth2 network lookup:
eth2: no IPv4 address assigned
Decoding Ethernet on interface eth2
21 Nov 09:00:27 (process:14929) INFO: Connecting to 127.0.0.1:4690
prelude Manager server.
21 Nov 09:00:27 (process:14929) INFO: TLS authentication succeed with
Prelude Manager.
Thanks,
--
Jason Dixon
OmniTI Computer Consulting, Inc.
[email protected]
443.325.1357 x.241
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user