Project

General

Profile

Bug #281

Prelude-manager not working

Added by about 16 years ago. Updated almost 15 years ago.

Status:
Closed
Priority:
Normal
Target version:
Start date:
Due date:
% Done:

0%

Resolution:
invalid

Description

Have been working with Prelude for quite some time and still having an issue getting the Prewikka front-end to acknowledge any sensors including prelude-manager, lml, and snort. I have seen many tickets regarding the same issue but have not seen a remedy. Please advise. Would greatly appreciate it..thanks!

prelude-manager.conf View - prelude-manager configuration file (8.77 KB) , 04/05/2008 09:01 PM

History

#1 Updated by about 16 years ago

This was resolved by adding the -conf and pointing it to the /etc/prelude/... part for each of the sensors.

For example prelude-manger --conf /etc/prelude-manager/prelude-manager.conf
as opposed to just prelude-manager

#2 Updated by Yoann VANDOORSELAERE about 16 years ago

Would it be possible that you got several instance of prelude-manager installed on your system ? Could you provide the output for the following commands:

which prelude-manager
strace prelude-manager 2>&1 | grep "prelude-manager.conf" 

#3 Updated by about 16 years ago

You are right. Our capstone group is implementing prelude along with lml,snort,ossec and nagios. We figured out that our defualt installs were going to usr/local/etc/~ but our program was running out of /etc/~ so when we registered our profiles they were bieng put in /usr/local/etc/~ so I just copied them over to /etc/prelude/profile/ - not sure if that is the best way to do it but it worked. Our agents are on, events are happening - just no correlation yet. Thanks for the help I greatly appreciate it.

#4 Updated by about 16 years ago

last post was by me, we are also using wireshark for our verification box to verify what prelude is getting. Do you know of a better tool to use since you work with prelude so much to verify the data ?

#5 Updated by Yoann VANDOORSELAERE about 16 years ago

  • Status changed from New to Closed
  • Resolution set to invalid

Sending your question to the mailing list will allow you to benefit from the community experience, don't hesitate to subscribe through http://lists.prelude-ids.org

I'm marking this ticket as closed, since it appear to be a prefix issue.

#6 Updated by Yoann VANDOORSELAERE almost 15 years ago

  • Project changed from PRELUDE SIEM to Prelude Manager
  • Category deleted (3)
  • Target version deleted (0.9.13)

Also available in: Atom PDF