Re: No alerts in Prewikka

have you tried to see if prelude-manager actually inserts events to  
the database?

theres an option to prelude-manager (--db -l or something like that)  
that logs the sql commands.


On Nov 18, 2009, at 9:36 PM, Robert Vineyard wrote:

> I found some additional information here:
>
> https://dev.prelude-ids.com/wiki/1/FrequentlyAskedQuestions#Sensors-are-running-but-I-see-no-events-and-agents-in-Prewikka
>
> I re-ran prelude-manager with the suggested debug options and it  
> appears
> that it is indeed processing sensor alerts and heartbeats.
>
> I also tried running prewikkapro-httpd in the foreground on the  
> command line
> (I've been running it under apache with mod_python) and saw that I was
> getting python errors about missing imports from Cheetah. I'm using  
> Ubuntu
> Hardy (version 8.04) which comes with an older version of Cheetah  
> which I
> assumed might have been causing the problem. I uninstalled this older
> version and attempted to run with the version that is included with  
> the
> prewikkapro installation, but continued to receive errors about  
> missing
> imports. I then tried installing the latest stable version of  
> Cheetah from
> the author's website and received still more import errors, again  
> different
> from the previous ones. Finally, I peeked inside the Cheetah package
> included with prewikkapro and saw that it was using version 2.2.1.  
> From
> there I downloaded a source tarball of Cheetah version 2.2.1 from the
> author's website and installed it, and finally prewikkapro-httpd  
> would start
> up without errors.
>
> However, browsing to port 8000 on my prewikkapro server still shows  
> me no
> events despite the above debugging efforts. What am I doing wrong  
> here?
>
> --
> [ Robert Vineyard | RHCE, Security+ ]    [ [email protected] 
>   ]
> [ Information Security Engineer III ]    [ 404.385.6900 | FAX  
> 404.894.4690 ]
> [Finding a needle in a haystack isn't hard when every straw is  
> computerized]
>
>
> Robert Vineyard wrote:
>> I think I've finally got my Prelude setup mostly up and running. I've
>> verified that there are a bunch of snort alerts in the prelude  
>> database, and
>> both postgres and prelude-manager see quite a spike in utilization  
>> when I
>> fire up my snort sensors.
>>
>> The problem is, now that I've got Prewikka (actually PrewikkaPro)  
>> hooked up,
>> it is able to see my snort agents but does not display any events  
>> coming out
>> of them. Did I miss something in the Prewikka setup?
>>
>> Thanks!
>>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user