Troubleshooting prelude-manager unresponsiveness
Robert Vineyard <[email protected]> Tue, 24 Nov 2009 12:31:09 -0500
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Now that I've had Prelude up and running for a few days, things have been getting gradually slower and slower as I accumulate more data. At this point prelude-manager is almost totally unresponsive, and snort sensor startups and things like prewikka seem to hang indefinitely when attempting to connect to my prelude-manager. Prewikka is reporting that both the manager and the sensors are down and is complaining about missing heartbeats for several hours. Looking in the var/spool directories under my prelude installation, I see accumulations of very large (several gigabytes) files on both my snort machine and on my prelude-manager machine. I assume this means I'm not processing the alerts fast enough in prelude-manager? For what it's worth, the spool files are much larger on the prelude-manager side than on the snort side. How should I go about troubleshooting this? -- [ Robert Vineyard | RHCE, Security+ ] [ [email protected] ] [ Information Security Engineer III ] [ 404.385.6900 | FAX 404.894.4690 ] [Finding a needle in a haystack isn't hard when every straw is computerized] _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user