Sensor problems
"Schubert, Aaron" <[email protected]> Fri, 9 Jul 2010 10:16:32 -0500
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
I have a prelude server running just fine but I cannot get the sensor to
show up under agents.
Server Box 10.10.10.1
Sensor Box 10.10.10.2
Server shows 1 Node and 3 Analyzers under agents in Prewikka, all online
and working fine, which are:
Prelude-correlator
Prelude-lml
Prelude-manager
On the sensor box:
Installed is libprelude and libprelude-lml (don't need libpreludedb
right?)
/etc/prelude/default/global.conf
Node-name = test_sensor
Node-location = test
[Node-Address]
Address = 10.10.10.2
Netmask = 255.255.255.0
Category = ipv4-addr
/etc/prelude-lml/prelude-lml.conf
[prelude]
Server-addr = 10.10.10.1
[format=syslog]
Time-format (the defaults here)
Prefix-regex (the defaults here)
File = /var/log/messages
File = /var/log/sercure
Prelude-admin register prelude-lml "idmef:w admin:r" 10.10.10.1 -uid 0
-gid0
On the server
Prelude-admin registration-server prelude-manager
The registration process goes without a problem. Restart both boxes with
processes running and no iptables or selinux in the way. Nothing shows
up under agents except 1 node (localhost) and three analyzers wich is
the Prelude-correlator, Prelude-lml, and Prelude-manager.
Why does the sensor box not show up? How can I show a sensor list
command line?
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user