Strange prelude-lml problem
smurray1 <[email protected]> Thu, 04 Mar 2010 19:58:27 -0500
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hello, I am having a strange problem with prelude-lml. When prelude-lml starts, it reads the logs correctly (from the last entry is successfully processed) up until the point that a new entry is added to the log. (That is, when lml starts it correctly processes all the entry in the logs and then stops when it processes the last item that was in the log when it first opens the log.) I have run lml in debug mode and I am not getting any errors. I configured lml not use pcre, but rather use the debug plugin and get the same behavior. It's as if lml does not realize that new entries have been added to the log, or that it cannot read the log after new entries are added to the log. I am running prelude-lml-0.9.14 on the latest version of Ubuntu Workstation (9.10- Karmic Koala) on an AMD-64 machine. I had been using lml in the past with no problems, but I upgraded to Ubuntu 9.10 and I also am now using rsyslog to send log information from other machines to this computer (over tcp). So perhaps either or both of those are causing the issues. Does anyone have any ideas what may be the issue or how I can begin to troubleshoot the problem? Thank You! stmurray _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-technologies.com/mailman/listinfo/prelude-user