Re: No alerts in Prewikka

Yes, I've verified that the events are indeed getting inserted into the
database both via the method you describe and by looking directly at the
rows in the database tables.

This prelude-manager instance is currently collecting events from 16
load-balanced snorts sniffing an aggregated 10gb tap, so the volume is very
high. I expected to see a bit of reporting latency due to this factor (I'll
get to optimization later on), but I've been recording data for several days
and still do not see a single alert inside PrewikkaPro.

--
[ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
[ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
[Finding a needle in a haystack isn't hard when every straw is computerized]


Nico wrote:
> have you tried to see if prelude-manager actually inserts events to the
> database?
> 
> theres an option to prelude-manager (--db -l or something like that)
> that logs the sql commands.
> 
> 
> On Nov 18, 2009, at 9:36 PM, Robert Vineyard wrote:
> 
>> I found some additional information here:
>>
>> https://dev.prelude-ids.com/wiki/1/FrequentlyAskedQuestions#Sensors-are-running-but-I-see-no-events-and-agents-in-Prewikka
>>
>>
>> I re-ran prelude-manager with the suggested debug options and it appears
>> that it is indeed processing sensor alerts and heartbeats.
>>
>> I also tried running prewikkapro-httpd in the foreground on the
>> command line
>> (I've been running it under apache with mod_python) and saw that I was
>> getting python errors about missing imports from Cheetah. I'm using
>> Ubuntu
>> Hardy (version 8.04) which comes with an older version of Cheetah which I
>> assumed might have been causing the problem. I uninstalled this older
>> version and attempted to run with the version that is included with the
>> prewikkapro installation, but continued to receive errors about missing
>> imports. I then tried installing the latest stable version of Cheetah
>> from
>> the author's website and received still more import errors, again
>> different
>> from the previous ones. Finally, I peeked inside the Cheetah package
>> included with prewikkapro and saw that it was using version 2.2.1. From
>> there I downloaded a source tarball of Cheetah version 2.2.1 from the
>> author's website and installed it, and finally prewikkapro-httpd would
>> start
>> up without errors.
>>
>> However, browsing to port 8000 on my prewikkapro server still shows me no
>> events despite the above debugging efforts. What am I doing wrong here?
>>
>> -- 
>> [ Robert Vineyard | RHCE, Security+ ]    [
>> [email protected]  ]
>> [ Information Security Engineer III ]    [ 404.385.6900 | FAX
>> 404.894.4690 ]
>> [Finding a needle in a haystack isn't hard when every straw is
>> computerized]
>>
>>
>> Robert Vineyard wrote:
>>> I think I've finally got my Prelude setup mostly up and running. I've
>>> verified that there are a bunch of snort alerts in the prelude
>>> database, and
>>> both postgres and prelude-manager see quite a spike in utilization
>>> when I
>>> fire up my snort sensors.
>>>
>>> The problem is, now that I've got Prewikka (actually PrewikkaPro)
>>> hooked up,
>>> it is able to see my snort agents but does not display any events
>>> coming out
>>> of them. Did I miss something in the Prewikka setup?
>>>
>>> Thanks!
>>>
>> _______________________________________________
>> Prelude-user site list
>> [email protected]
>> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
> 
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user