prelude-lml
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
I have a running prelude/prewikka system but prelude-lml is not working
properly on all but one sensor.
The sensors as of now are a rishi client listenning to a nic and
prelude-lml for forwarding the analyzed logs to the prelude-manager.
All the packages were build via source.
This is what my prelude-lml.conf looks like.
----
include = /usr/local/etc/prelude/default/idmef-client.conf
[format=rishi]
time-format = "%Y-%m-%d %H:%M:%S"
prefix-regex = "^(?P<timestamp>.{19}),\d+ "
file = /build/rishi/logs/stdout.log
ruleset=/usr/local/etc/prelude-lml/ruleset/pcre.rules
----
Rishi seems to be working alright and is writing logs with about 500
entries a day.
Everytime I start prelude-lml on one of the non working sensors I get
this message.
----
# prelude-lml 10 Apr 10:55:05 (process:2796) INFO: PCRE plugin loaded
443 rules.
10 Apr 10:55:05 (process:2796) INFO: Connecting to 172.22.98.170:4690
prelude Manager server.
10 Apr 10:55:05 (process:2796) INFO: TLS authentication succeed with
Prelude Manager.
10 Apr 10:55:05 (process:2796) INFO: /build/rishi/logs/stdout.log: No
metadata available, starting from tail.
----
I have a working sensor but the config looks the same compared to the
non working ones.
Do you have any ideas what to look for next?
Thanks
Arthur
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user