Re: No alerts in Prewikka

I found some additional information here:

https://dev.prelude-ids.com/wiki/1/FrequentlyAskedQuestions#Sensors-are-running-but-I-see-no-events-and-agents-in-Prewikka

I re-ran prelude-manager with the suggested debug options and it appears
that it is indeed processing sensor alerts and heartbeats.

I also tried running prewikkapro-httpd in the foreground on the command line
(I've been running it under apache with mod_python) and saw that I was
getting python errors about missing imports from Cheetah. I'm using Ubuntu
Hardy (version 8.04) which comes with an older version of Cheetah which I
assumed might have been causing the problem. I uninstalled this older
version and attempted to run with the version that is included with the
prewikkapro installation, but continued to receive errors about missing
imports. I then tried installing the latest stable version of Cheetah from
the author's website and received still more import errors, again different
from the previous ones. Finally, I peeked inside the Cheetah package
included with prewikkapro and saw that it was using version 2.2.1. From
there I downloaded a source tarball of Cheetah version 2.2.1 from the
author's website and installed it, and finally prewikkapro-httpd would start
up without errors.

However, browsing to port 8000 on my prewikkapro server still shows me no
events despite the above debugging efforts. What am I doing wrong here?

--
[ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
[ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
[Finding a needle in a haystack isn't hard when every straw is computerized]


Robert Vineyard wrote:
> I think I've finally got my Prelude setup mostly up and running. I've 
> verified that there are a bunch of snort alerts in the prelude database, and 
> both postgres and prelude-manager see quite a spike in utilization when I 
> fire up my snort sensors.
> 
> The problem is, now that I've got Prewikka (actually PrewikkaPro) hooked up, 
> it is able to see my snort agents but does not display any events coming out 
> of them. Did I miss something in the Prewikka setup?
> 
> Thanks!
> 
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user