Everything is running but no events in database or in prewikka gui
Trevor McLeod <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hello, Currently, we have about 1500 devices forwarding syslog events to a central loghost. The loghost is currently forwarding those events to a workstation running SuSE 11.1 and Prelude-IDS. Everything seems to be running but I can find no data in the database. If I interrogate the system with prewikka there are no events displayed. I know that the workstation is receiving events from the loghost because the /var/log/messages file grows every second. The following components are running on the SuSE workstation: prelude-manager, prelude-correlator, prelude-lml, prewikka-httpd and mysql. The prelude-manager accepts the certificate from prelude-lml and prelude-correlator when the agents are started. The web interface works on another workstation. I can log in to the web interface using the preconfigured admin account. If I log into MySQL, select the prelude database and issue the command "select * from Prelude_Alert;" there are 0 records. I must be missing something really basic. Suggestions? -- Trevor McLeod Systems Analyst UBC, Department of Computer Science X463-2366 Main Mall Vancouver, B.C. Canada V6T 1Z4 Phone: +1 604 822-8285 _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user