Troubleshooting prelude-manager unresponsiveness

Robert Vineyard <[email protected]> Tue, 24 Nov 2009 12:31:09 -0500
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <[email protected]>
Now that I've had Prelude up and running for a few days, things have been
getting gradually slower and slower as I accumulate more data. At this point
prelude-manager is almost totally unresponsive, and snort sensor startups
and things like prewikka seem to hang indefinitely when attempting to
connect to my prelude-manager. Prewikka is reporting that both the manager
and the sensors are down and is complaining about missing heartbeats for
several hours.

Looking in the var/spool directories under my prelude installation, I see
accumulations of very large (several gigabytes) files on both my snort
machine and on my prelude-manager machine. I assume this means I'm not
processing the alerts fast enough in prelude-manager? For what it's worth,
the spool files are much larger on the prelude-manager side than on the
snort side. How should I go about troubleshooting this?

-- 
[ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
[ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
[Finding a needle in a haystack isn't hard when every straw is computerized]
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user