Re: Prelude intallation

Hi,

Thanks for you reply..

Hope you can help me with the below informations, Still i am not received 
the events.




[root@localhost ~]# prewikka-httpd
----------------------------------------
Exception happened during processing of request from ('192.168.2.77', 
24976)
Traceback (most recent call last):
  File "/usr/lib/python2.4/SocketServer.py", line 463, in 
process_request_thread
    self.finish_request(request, client_address)
  File "/usr/lib/python2.4/SocketServer.py", line 254, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.4/SocketServer.py", line 521, in __init__
    self.handle()
  File "/usr/lib/python2.4/BaseHTTPServer.py", line 316, in handle
    self.handle_one_request()
  File "/usr/lib/python2.4/BaseHTTPServer.py", line 310, in 
handle_one_request
    method()
  File "/usr/bin/prewikka-httpd", line 113, in do_GET
    self._processDynamic(cgi.parse_qs(self.path[2:]))
  File "/usr/bin/prewikka-httpd", line 76, in _processDynamic
    self.server.core.process(self)
  File "/usr/lib/python2.4/site-packages/prewikka/Core.py", line 369, in 
process
    request.sendResponse()
  File "/usr/bin/prewikka-httpd", line 80, in sendResponse
    Request.Request.sendResponse(self)
  File "/usr/lib/python2.4/site-packages/prewikka/Request.py", line 74, in 
sendResponse
    self.write(self.output_cookie.output() + "\r\n")
  File "/usr/bin/prewikka-httpd", line 59, in write
    self.wfile.write(data)
  File "/usr/lib/python2.4/socket.py", line 256, in write
    self.flush()
  File "/usr/lib/python2.4/socket.py", line 243, in flush
    self._sock.sendall(buffer)
error: (32, 'Broken pipe')


********************************************************************************
[root@localhost ~]# prelude-manager
19 Aug 16:39:36 (process:3891) INFO: Subscribing Normalize to active 
decoding plugins.
19 Aug 16:39:36 (process:3891) INFO: server started (listening on 
127.0.0.1 port 4690).
19 Aug 16:39:36 (process:3891) INFO: Subscribing db[default] to active 
reporting plugins.
19 Aug 16:39:36 (process:3891) INFO: Subscribing Debug[default] to active 
reporting plugins.
19 Aug 16:44:35 (process:3891) INFO: Generating 1024 bits Diffie-Hellman 
key for TLS...
19 Aug 16:55:19 (process:3891) INFO: [127.0.0.1:49594]: closing 
connection.
19 Aug 21:34:28 (process:3891) INFO: [127.0.0.1:49597]: closing 
connection.
20 Aug 02:13:36 (process:3891) INFO: [127.0.0.1:49599]: closing 
connection.
20 Aug 06:52:44 (process:3891) INFO: [127.0.0.1:49604]: closing 
connection.


***************************************

[root@localhost ~]# prelude-lml
19 Aug 17:06:04 (process:4029) INFO: PCRE plugin loaded 443 rules.
19 Aug 17:06:04 (process:4029) INFO: Connecting to 192.168.0.171:4690 
prelude Manager server.
19 Aug 17:06:04 (process:4029) WARNING: Failover enabled: connection error 
with 192.168.0.171:4690: Connection refused
19 Aug 17:07:08 (process:4029) INFO: /var/log/secure: resuming log 
analyzis at offset 5186.
19 Aug 17:07:08 (process:4029) WARNING: /var/log/named_security.log does 
not exist.
19 Aug 17:07:08 (process:4029) INFO: /var/log/maillog: resuming log 
analyzis at offset 7459.
19 Aug 17:07:08 (process:4029) WARNING: /var/log/asterisk/messages does 
not exist.
19 Aug 17:07:08 (process:4029) INFO: /var/log/httpd/access_log: No 
metadata available, starting from tail.
19 Aug 17:07:08 (process:4029) WARNING: /var/log/everything/current does 
not exist.
19 Aug 17:07:08 (process:4029) INFO: /var/log/messages: resuming log 
analyzis at offset 116181.
19 Aug 17:07:08 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 19 15:15:46 localhost sshd[3826]: pam_unix(sshd:session): 
session opened for user root by (uid=0)'.
19 Aug 17:07:08 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 19 17:02:08 localhost sshd[3966]: Accepted password for 
root from 192.168.2.77 port 25118 ssh2'.
19 Aug 17:07:08 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 19 05:05:08 localhost sendmail[3728]: n7INMF3q003725: 
to=<[email protected]>, ctladdr=<[email protected]> 
(0/0), delay=00:12:53, xdelay=00:00:32, mailer=local, pri=31114, 
dsn=2.0.0, stat=Sent'.
19 Aug 17:07:08 (process:4029) INFO: Connecting to 192.168.0.171:4690 
prelude Manager server.
19 Aug 17:07:08 (process:4029) WARNING: Failover enabled: connection error 
with 192.168.0.171:4690: Connection refused
19 Aug 17:07:08 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 19 17:02:08 localhost sshd[3966]: pam_unix(sshd:session): 
session opened for user root by (uid=0)'.
19 Aug 17:07:08 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 19 17:04:40 localhost sshd[3999]: Accepted password for 
root from 192.168.2.77 port 25130 ssh2'.
19 Aug 17:07:08 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 19 17:04:40 localhost sshd[3999]: pam_unix(sshd:session): 
session opened for user root by (uid=0)'.
19 Aug 21:35:32 (process:4029) INFO: Connecting to 192.168.0.171:4690 
prelude Manager server.
19 Aug 21:35:32 (process:4029) WARNING: Failover enabled: connection error 
with 192.168.0.171:4690: Connection refused
20 Aug 02:03:56 (process:4029) INFO: Connecting to 192.168.0.171:4690 
prelude Manager server.
20 Aug 02:03:56 (process:4029) WARNING: Failover enabled: connection error 
with 192.168.0.171:4690: Connection refused
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:02:35 localhost sendmail[4992]: n7JMW4oD004992: 
from=root, size=1216, class=0, nrcpts=1, 
msgid=<[email protected]>, 
relay=root@localhost'.
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:13:50 localhost sendmail[5017]: n7JMWZMS005017: 
from=<[email protected]>, size=1496, class=0, nrcpts=1, 
msgid=<[email protected]>, proto=ESMTP, 
daemon=MTA, relay=localhost.localdomain [127.0.0.1]'.
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:13:50 localhost sendmail[4992]: n7JMW4oD004992: 
to=root, ctladdr=root (0/0), delay=00:11:46, xdelay=00:11:15, 
mailer=relay, pri=31216, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, 
stat=Sent (n7JMWZMS005017 Message accepted for delivery)'.
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:17:09 localhost sendmail[5029]: n7JMWZMS005017: 
to=<[email protected]>, ctladdr=<[email protected]> 
(0/0), delay=00:14:34, xdelay=00:01:41, mailer=local, pri=31730, 
dsn=2.0.0, stat=Sent'.
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:17:37 localhost sendmail[5033]: n7JMjSMg005033: 
from=root, size=606, class=0, nrcpts=1, 
msgid=<[email protected]>, 
relay=root@localhost'.
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:29:25 localhost sendmail[5175]: n7JMm8Mj005175: 
from=<[email protected]>, size=885, class=0, nrcpts=1, 
msgid=<[email protected]>, proto=ESMTP, 
daemon=MTA, relay=localhost.localdomain [127.0.0.1]'.
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:29:25 localhost sendmail[5033]: n7JMjSMg005033: 
to=root, ctladdr=root (0/0), delay=00:13:57, xdelay=00:11:17, 
mailer=relay, pri=30606, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, 
stat=Sent (n7JMm8Mj005175 Message accepted for delivery)'.
20 Aug 06:32:20 (process:4029) WARNING: no appropriate format defined for 
log entry: 'Aug 20 04:31:34 localhost sendmail[5187]: n7JMm8Mj005175: 
to=<[email protected]>, ctladdr=<[email protected]> 
(0/0), delay=00:13:26, xdelay=00:00:33, mailer=local, pri=31114, 
dsn=2.0.0, stat=Sent'.
20 Aug 06:32:20 (process:4029) INFO: Connecting to 192.168.0.171:4690 
prelude Manager server.
20 Aug 06:32:20 (process:4029) WARNING: Failover enabled: connection error 
with 192.168.0.171:4690: Connection refused


20 Aug 06:52:44 (process:3804) WARNING: no appropriate format defined for 
log try: 'Aug 20 04:29:25 localhost sendmail[5033]: n7JMjSMg005033: 
to=root, ctlad=root (0/0), delay=00:13:57, xdelay=00:11:17, mailer=relay, 
pri=30606, relay=[7.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent 
(n7JMm8Mj005175 Message accepted fodelivery)'.
20 Aug 06:52:44 (process:3804) WARNING: no appropriate format defined for 
log try: 'Aug 20 04:31:34 localhost sendmail[5187]: n7JMm8Mj005175: 
to=<[email protected]>, ctladdr=<[email protected]> (0/0), 
delay=00:13:26, xlay=00:00:33, mailer=local, pri=31114, dsn=2.0.0, 
stat=Sent'.




From:
"G Ramon Gomez" <[email protected]>
To:
"Mathew Vaidyan" <[email protected]>, 
<[email protected]>
Date:
08/19/2009 09:58 PM
Subject:
RE: [prelude-user] Prelude intallation



Right now it looks like you only have a single agent (prelude-manager). 
You’ll need to install something to feed events into the system if you 
want them to pop up.
Prelude-LML is your most likely candidate, but you need a central location 
to consolidate syslog.
 
-          Ramon
 
From: Mathew Vaidyan [mailto:[email protected]] 
Sent: Wednesday, August 19, 2009 5:02 AM
To: G Ramon Gomez; [email protected]
Subject: RE: [prelude-user] Prelude intallation
 
Hi, 

As of now i am able to add Agents,Hope you will help me to get the 
Events.. 

Please respond.. 

Regards, 

Mathew 






DISCLAIMER: 

"The information in this e-mail and any attachment is intended only for 
the person to whom it is addressed and may contain confidential and/or 
privileged material. If you have received this e-mail in error, kindly 
contact the sender and destroy all copies of the original communication. 
IBS makes no warranty, express or implied, nor guarantees the accuracy, 
adequacy or completeness of the information contained in this email or any 
attachment and is not liable for any errors, defects, omissions, viruses 
or for resultant loss or damage, if any, direct or indirect."





_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user