Re: Sensor problems

Great.  Add the additional listen line in prelude-manager.conf, which will
be in /usr/local/etc/prelude-manager if you use the default install.  Then
restart the prelude manager on your manager server, and then restart lml on
your sensor.

On Fri, Jul 9, 2010 at 11:40 AM, Schubert, Aaron
<[email protected]>wrote:

>  Sorry looked at the server twice.
>
>
>
> Server is listening on 127.0.0.1
>
>
>
> Sensor show nothing when issuing netstat –anp | grep 4690, but when I issue
> netstat –anp | grep prelude I get:
>
>
>
> Unix  2                  []
> DGRAM                                                17084
> 1961/prelude-lml
>
>
>
> *From:* ScottO [mailto:[email protected]]
> *Sent:* Friday, July 09, 2010 10:36 AM
> *To:* Schubert, Aaron
> *Cc:* [email protected]
>
> *Subject:* Re: [prelude-user] Sensor problems
>
>
>
> Not sure I follow, the sensor is listening on 127.0.0.1?  Or did you mean
> the server here....  If in fact the sensor, what process is listening on
> 127.0.0.1?
>
> On Fri, Jul 9, 2010 at 11:33 AM, Schubert, Aaron <[email protected]>
> wrote:
>
> The prelude-sensor box is listening on it’s loopback 127.0.0.1, not
> 10.10.10.1.  Where/how do I change this?
>
>
>
> *From:* ScottO [mailto:[email protected]]
> *Sent:* Friday, July 09, 2010 10:26 AM
> *To:* Schubert, Aaron
> *Cc:* [email protected]
> *Subject:* Re: [prelude-user] Sensor problems
>
>
>
> Few things to check.
>
>
>
> On your server box in prelude-manger.conf or on the cli, what IPs are you
> listening on?  Make sure 10.10.10.1 is there, you could also do a netstat
> -anp | grep 4690 and see them there, make sure one is 10.10.10.1.
>
> Next, you could do the same netstat -anp | grep 4690 on the sensor and see
> if there is an established connection to 10.10.10.1.
>
> Finally, can you run lml not daemonized and put what you see on the cli, it
> should hopefully show and error or not connecting, etc.
>
> scotto
>
> On Fri, Jul 9, 2010 at 11:16 AM, Schubert, Aaron <[email protected]>
> wrote:
>
> I have a prelude server running just fine but I cannot get the sensor to
> show up under agents.
>
>
>
> Server Box 10.10.10.1
>
> Sensor Box 10.10.10.2
>
>
>
> Server shows 1 Node and 3 Analyzers under agents in Prewikka, all online
> and working fine, which are:
>
> Prelude-correlator
>
> Prelude-lml
>
> Prelude-manager
>
>
>
> On the sensor box:
>
>
>
> Installed is libprelude and libprelude-lml (don't need libpreludedb
> right?)
>
>
>
> /etc/prelude/default/global.conf
>
>                Node-name = test_sensor
>
>                Node-location = test
>
>
>
>                [Node-Address]
>
>                Address = 10.10.10.2
>
>                Netmask = 255.255.255.0
>
>                Category = ipv4-addr
>
> /etc/prelude-lml/prelude-lml.conf
>
>                [prelude]
>
>                Server-addr = 10.10.10.1
>
>                [format=syslog]
>
>                Time-format (the defaults here)
>
>                Prefix-regex (the defaults here)
>
>                File = /var/log/messages
>
>                File = /var/log/sercure
>
>
>
> Prelude-admin register prelude-lml "idmef:w admin:r" 10.10.10.1 -uid 0
> -gid0
>
>
>
> On the server
>
>
>
> Prelude-admin registration-server prelude-manager
>
>
>
> The registration process goes without a problem. Restart both boxes with
> processes running and no iptables or selinux in the way.  Nothing shows
> up under agents except 1 node (localhost) and three analyzers wich is
> the Prelude-correlator, Prelude-lml, and Prelude-manager.
>
>
>
> Why does the sensor box not show up?  How can I show a sensor list
> command line?
>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
>
>
>
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user