Re: Prewikka not reporting agents or events
Jason Dixon <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Nov 21, 2008 at 09:01:13AM -0500, Jason Dixon wrote: > On Fri, Nov 21, 2008 at 01:02:34PM +0100, Yoann Vandoorselaere wrote: > > Le jeudi 20 novembre 2008 ?? 17:03 -0500, Jason Dixon a ??crit : > > > On Thu, Nov 20, 2008 at 11:23:29AM -0500, ScottO wrote: > > > > That's truly strange. It will normally print something right around line > > > > 226 in your output, right after the Decoding Ethernet on interface blah > > > > line. > > > > > > Ok, I found the problem but I'm stuck on something else. The issue was > > > caused by /etc/sysconfig/snort, which had "-A fast" enabled. Apparently > > > this causes it to skip output plugins. I discovered this while trying > > > to get snort to log to database. > > > > > > Now I'm running into permissions errors with the sensor. I've recreated > > > the profile but the analyzerid file is still owned root:root and I'm not > > > sure how to proceed. > > > > You might want to use the 'prelude-admin chown' command along with --uid > > and --gid option to reset the whole profile permission to the user/group > > you want to use. > > That did it! :) Sorry, I spoke too soon. Although snort claims to connect with Prelude Manager, I'm still not seeing any agents or events in prewikka. I restarted prelude-manager with debugging enabled and can see a steady flow of alerts from snort. I went back and confirmed that libpreludedb support was built in for prelude-manager: $ grep libpreludedb prelude-manager-0.9.14.2/config.log configure:33403: checking for libpreludedb-config configure:33421: found /usr/local/bin/libpreludedb-config configure:33434: result: /usr/local/bin/libpreludedb-config configure:33443: checking for libpreludedb - version >= 0.9.4 ac_cv_path_LIBPRELUDEDB_CONFIG=/usr/local/bin/libpreludedb-config LIBPRELUDEDB_CONFIG='/usr/local/bin/libpreludedb-config' Any ideas? -- Jason Dixon OmniTI Computer Consulting, Inc. [email protected] 443.325.1357 x.241 _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user