Re: Sensor problems

Not sure I follow, the sensor is listening on 127.0.0.1?  Or did you mean
the server here....  If in fact the sensor, what process is listening on
127.0.0.1?

On Fri, Jul 9, 2010 at 11:33 AM, Schubert, Aaron
<[email protected]>wrote:

>  The prelude-sensor box is listening on it’s loopback 127.0.0.1, not
> 10.10.10.1.  Where/how do I change this?
>
>
>
> *From:* ScottO [mailto:[email protected]]
> *Sent:* Friday, July 09, 2010 10:26 AM
> *To:* Schubert, Aaron
> *Cc:* [email protected]
> *Subject:* Re: [prelude-user] Sensor problems
>
>
>
> Few things to check.
>
>
> On your server box in prelude-manger.conf or on the cli, what IPs are you
> listening on?  Make sure 10.10.10.1 is there, you could also do a netstat
> -anp | grep 4690 and see them there, make sure one is 10.10.10.1.
>
> Next, you could do the same netstat -anp | grep 4690 on the sensor and see
> if there is an established connection to 10.10.10.1.
>
> Finally, can you run lml not daemonized and put what you see on the cli, it
> should hopefully show and error or not connecting, etc.
>
> scotto
>
>  On Fri, Jul 9, 2010 at 11:16 AM, Schubert, Aaron <
> [email protected]> wrote:
>
> I have a prelude server running just fine but I cannot get the sensor to
> show up under agents.
>
>
>
> Server Box 10.10.10.1
>
> Sensor Box 10.10.10.2
>
>
>
> Server shows 1 Node and 3 Analyzers under agents in Prewikka, all online
> and working fine, which are:
>
> Prelude-correlator
>
> Prelude-lml
>
> Prelude-manager
>
>
>
> On the sensor box:
>
>
>
> Installed is libprelude and libprelude-lml (don't need libpreludedb
> right?)
>
>
>
> /etc/prelude/default/global.conf
>
>                Node-name = test_sensor
>
>                Node-location = test
>
>
>
>                [Node-Address]
>
>                Address = 10.10.10.2
>
>                Netmask = 255.255.255.0
>
>                Category = ipv4-addr
>
> /etc/prelude-lml/prelude-lml.conf
>
>                [prelude]
>
>                Server-addr = 10.10.10.1
>
>                [format=syslog]
>
>                Time-format (the defaults here)
>
>                Prefix-regex (the defaults here)
>
>                File = /var/log/messages
>
>                File = /var/log/sercure
>
>
>
> Prelude-admin register prelude-lml "idmef:w admin:r" 10.10.10.1 -uid 0
> -gid0
>
>
>
> On the server
>
>
>
> Prelude-admin registration-server prelude-manager
>
>
>
> The registration process goes without a problem. Restart both boxes with
> processes running and no iptables or selinux in the way.  Nothing shows
> up under agents except 1 node (localhost) and three analyzers wich is
> the Prelude-correlator, Prelude-lml, and Prelude-manager.
>
>
>
> Why does the sensor box not show up?  How can I show a sensor list
> command line?
>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
>
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user