Re: Sensor problems

There you go!  Add a Listen = 10.10.10.1 and restart the manager, then
restart lml.

On Fri, Jul 9, 2010 at 11:28 AM, Schubert, Aaron
<[email protected]>wrote:

>  On the server box:
>
>
>
> Listen = 127.0.0.1
>
>
>
> *From:* ScottO [mailto:[email protected]]
> *Sent:* Friday, July 09, 2010 10:26 AM
> *To:* Schubert, Aaron
> *Cc:* [email protected]
> *Subject:* Re: [prelude-user] Sensor problems
>
>
>
> Few things to check.
>
> On your server box in prelude-manger.conf or on the cli, what IPs are you
> listening on?  Make sure 10.10.10.1 is there, you could also do a netstat
> -anp | grep 4690 and see them there, make sure one is 10.10.10.1.
>
> Next, you could do the same netstat -anp | grep 4690 on the sensor and see
> if there is an established connection to 10.10.10.1.
>
> Finally, can you run lml not daemonized and put what you see on the cli, it
> should hopefully show and error or not connecting, etc.
>
> scotto
>
>  On Fri, Jul 9, 2010 at 11:16 AM, Schubert, Aaron <
> [email protected]> wrote:
>
> I have a prelude server running just fine but I cannot get the sensor to
> show up under agents.
>
>
>
> Server Box 10.10.10.1
>
> Sensor Box 10.10.10.2
>
>
>
> Server shows 1 Node and 3 Analyzers under agents in Prewikka, all online
> and working fine, which are:
>
> Prelude-correlator
>
> Prelude-lml
>
> Prelude-manager
>
>
>
> On the sensor box:
>
>
>
> Installed is libprelude and libprelude-lml (don't need libpreludedb
> right?)
>
>
>
> /etc/prelude/default/global.conf
>
>                Node-name = test_sensor
>
>                Node-location = test
>
>
>
>                [Node-Address]
>
>                Address = 10.10.10.2
>
>                Netmask = 255.255.255.0
>
>                Category = ipv4-addr
>
> /etc/prelude-lml/prelude-lml.conf
>
>                [prelude]
>
>                Server-addr = 10.10.10.1
>
>                [format=syslog]
>
>                Time-format (the defaults here)
>
>                Prefix-regex (the defaults here)
>
>                File = /var/log/messages
>
>                File = /var/log/sercure
>
>
>
> Prelude-admin register prelude-lml "idmef:w admin:r" 10.10.10.1 -uid 0
> -gid0
>
>
>
> On the server
>
>
>
> Prelude-admin registration-server prelude-manager
>
>
>
> The registration process goes without a problem. Restart both boxes with
> processes running and no iptables or selinux in the way.  Nothing shows
> up under agents except 1 node (localhost) and three analyzers wich is
> the Prelude-correlator, Prelude-lml, and Prelude-manager.
>
>
>
> Why does the sensor box not show up?  How can I show a sensor list
> command line?
>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
>
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user