Re: No alerts in Prewikka

Perhaps I spoke to soon... now it appears that snort is unable to connect to
prelude-manager (running on a different machine on the same switch/subnet
with no network or host firewalls in the way). Looking at 'top' on the
system running prelude-manager, I see the prelude-manager and postgresql
processes using quite a bit of CPU. Also, nmaps from both the
prelude-manager machine and the snort machine show that the appropriate port
is open and listening for traffic.

While running prelude-manager with some of the debugging options enabled, I
frequently saw messages like this:

18 Nov 18:47:36 (process:21628) INFO: medium-buffer.1258398818: flushing
6799766 buffered messages from a previous run.

Again, I assume that the processing lag here is due to the volume of alerts
that I am getting, but I would expect to see *some* data in Prewikka.

--
[ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
[ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
[Finding a needle in a haystack isn't hard when every straw is computerized]


Robert Vineyard wrote:
> Yes, I've verified that the events are indeed getting inserted into the
> database both via the method you describe and by looking directly at the
> rows in the database tables.
> 
> This prelude-manager instance is currently collecting events from 16
> load-balanced snorts sniffing an aggregated 10gb tap, so the volume is very
> high. I expected to see a bit of reporting latency due to this factor (I'll
> get to optimization later on), but I've been recording data for several days
> and still do not see a single alert inside PrewikkaPro.
> 
> --
> [ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
> [ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
> [Finding a needle in a haystack isn't hard when every straw is computerized]
> 
> 
> Nico wrote:
>> have you tried to see if prelude-manager actually inserts events to the
>> database?
>>
>> theres an option to prelude-manager (--db -l or something like that)
>> that logs the sql commands.
>>
>>
>> On Nov 18, 2009, at 9:36 PM, Robert Vineyard wrote:
>>
>>> I found some additional information here:
>>>
>>> https://dev.prelude-ids.com/wiki/1/FrequentlyAskedQuestions#Sensors-are-running-but-I-see-no-events-and-agents-in-Prewikka
>>>
>>>
>>> I re-ran prelude-manager with the suggested debug options and it appears
>>> that it is indeed processing sensor alerts and heartbeats.
>>>
>>> I also tried running prewikkapro-httpd in the foreground on the
>>> command line
>>> (I've been running it under apache with mod_python) and saw that I was
>>> getting python errors about missing imports from Cheetah. I'm using
>>> Ubuntu
>>> Hardy (version 8.04) which comes with an older version of Cheetah which I
>>> assumed might have been causing the problem. I uninstalled this older
>>> version and attempted to run with the version that is included with the
>>> prewikkapro installation, but continued to receive errors about missing
>>> imports. I then tried installing the latest stable version of Cheetah
>>> from
>>> the author's website and received still more import errors, again
>>> different
>>> from the previous ones. Finally, I peeked inside the Cheetah package
>>> included with prewikkapro and saw that it was using version 2.2.1. From
>>> there I downloaded a source tarball of Cheetah version 2.2.1 from the
>>> author's website and installed it, and finally prewikkapro-httpd would
>>> start
>>> up without errors.
>>>
>>> However, browsing to port 8000 on my prewikkapro server still shows me no
>>> events despite the above debugging efforts. What am I doing wrong here?
>>>
>>> -- 
>>> [ Robert Vineyard | RHCE, Security+ ]    [
>>> [email protected]  ]
>>> [ Information Security Engineer III ]    [ 404.385.6900 | FAX
>>> 404.894.4690 ]
>>> [Finding a needle in a haystack isn't hard when every straw is
>>> computerized]
>>>
>>>
>>> Robert Vineyard wrote:
>>>> I think I've finally got my Prelude setup mostly up and running. I've
>>>> verified that there are a bunch of snort alerts in the prelude
>>>> database, and
>>>> both postgres and prelude-manager see quite a spike in utilization
>>>> when I
>>>> fire up my snort sensors.
>>>>
>>>> The problem is, now that I've got Prewikka (actually PrewikkaPro)
>>>> hooked up,
>>>> it is able to see my snort agents but does not display any events
>>>> coming out
>>>> of them. Did I miss something in the Prewikka setup?
>>>>
>>>> Thanks!
>>>>
>>> _______________________________________________
>>> Prelude-user site list
>>> [email protected]
>>> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user