Prelude-manager not working
Have been working with Prelude for quite some time and still having an issue getting the Prewikka front-end to acknowledge any sensors including prelude-manager, lml, and snort. I have seen many tickets regarding the same issue but have not seen a remedy. Please advise. Would greatly appreciate it..thanks!
#1 Updated by about 15 years ago
This was resolved by adding the -conf and pointing it to the /etc/prelude/... part for each of the sensors.
For example prelude-manger --conf /etc/prelude-manager/prelude-manager.conf
as opposed to just prelude-manager
#2 Updated by Yoann VANDOORSELAERE about 15 years ago
Would it be possible that you got several instance of prelude-manager installed on your system ? Could you provide the output for the following commands:
strace prelude-manager 2>&1 | grep "prelude-manager.conf"
#3 Updated by about 15 years ago
You are right. Our capstone group is implementing prelude along with lml,snort,ossec and nagios. We figured out that our defualt installs were going to usr/local/etc/~ but our program was running out of /etc/~ so when we registered our profiles they were bieng put in /usr/local/etc/~ so I just copied them over to /etc/prelude/profile/ - not sure if that is the best way to do it but it worked. Our agents are on, events are happening - just no correlation yet. Thanks for the help I greatly appreciate it.
#4 Updated by about 15 years ago
last post was by me, we are also using wireshark for our verification box to verify what prelude is getting. Do you know of a better tool to use since you work with prelude so much to verify the data ?
#5 Updated by Yoann VANDOORSELAERE about 15 years ago
- Status changed from New to Closed
- Resolution set to invalid
Sending your question to the mailing list will allow you to benefit from the community experience, don't hesitate to subscribe through http://lists.prelude-ids.org
I'm marking this ticket as closed, since it appear to be a prefix issue.
#6 Updated by Yoann VANDOORSELAERE about 14 years ago
- Project changed from PRELUDE SIEM to Prelude Manager
- Category deleted (
- Target version deleted (