Re: prelude and samhain...

Le mardi 06 avril 2010 à 12:36 +0100, Jaime Ventura a écrit :
> Hello,
>     I'm installing samhain on several servers as clients to a samhain
> logserver (yule) which is registered as a prelude analyzer.
>     The idea is to concentrate all logs to a unique prelude analyzer,
> instead of one analyzer per server.
>     Its working fine, i can see the reports on prelude via prewikka.

From the text you copied above, it is not clear what IDMEF fields are
used to store the different part of the Samhain events. Could you send a
screenshot of the main Prewikka events view, so that we can have a
better idea of what is going on ?

I'm also forwarding this mail to the Samhain support list, since a
modification in newer Samhain version might have broken Prelude support
code.

[...]

Regards,

>     But the messages are disappointing as they are not meaningful:
> 1 x CRIT : [2010-04-06T11:59:30+0100] msg= (succeeded
> <https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)
> 
> 1 x CRIT : [2010-04-06T11:59:30+0100] msg=(succeeded
> <https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)
> 
> 1 x ALERT : [2010-04-06T11:59:27+0100] msg=(succeeded
> <https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)
> 
> 1 x CRIT : [2010-04-06T11:59:31+0100] msg=(succeeded
> <https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)
> 
> 1 x CRIT : [2010-04-06T11:59:30+0100] msg=(succeeded
> <https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)1 40 24 65 10                      Fax: +33 (0)1 40 24 65 28
http://www.prelude-technologies.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user