/security-onion

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disabling PADS agent blocks PRADS and results in no SANCP records flowing #454

Closed
GoogleCodeExporter opened this Issue Mar 24, 2015 · 2 comments

Comments

Assignees
No one assigned
Labels
Projects
None yet
Milestone
No milestone
1 participant
@GoogleCodeExporter
@GoogleCodeExporter

GoogleCodeExporter commented Mar 24, 2015 

https://groups.google.com/d/topic/security-onion/k5KfS_0lIkU/discussion

Original issue reported on code.google.com by doug.bu...@gmail.com on 21 Dec 2013 at 11:12
@GoogleCodeExporter

This comment has been minimized.

Show comment
Hide comment
@GoogleCodeExporter

GoogleCodeExporter Mar 24, 2015 

Updated nsm_sensor_ps-start as follows:
-        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && process_start 
"prads" "-i $SENSOR_INTERFACE_SHORT -c /etc/nsm/$SENSOR/prads.conf -u 
$SENSOR_USER -g $SENSOR_GROUP -L /nsm/sensor_data/$SENSOR/sancp/ -f 
/nsm/sensor_data/$SENSOR/pads.fifo $PADS_OPTIONS -b \"$BPF\"" 
"$PROCESS_PID_DIR/$SENSOR/prads.pid" "$PROCESS_LOG_DIR/$SENSOR/prads.log" 
"prads (sessions/assets)"
+
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "yes" ] && [ "$SANCP_AGENT_ENABLED" == "yes" ] && 
process_start "prads" "-i $SENSOR_INTERFACE_SHORT -c 
/etc/nsm/$SENSOR/prads.conf -u $SENSOR_USER -g $SENSOR_GROUP -L 
/nsm/sensor_data/$SENSOR/sancp/ -f /nsm/sensor_data/$SENSOR/pads.fifo 
$PADS_OPTIONS -b \"$BPF\"" "$PROCESS_PID_DIR/$SENSOR/prads.pid" 
"$PROCESS_LOG_DIR/$SENSOR/prads.log" "prads (sessions/assets)"
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "no" ]  && [ "$SANCP_AGENT_ENABLED" == "yes" ] && 
process_start "prads" "-i $SENSOR_INTERFACE_SHORT -c 
/etc/nsm/$SENSOR/prads.conf -u $SENSOR_USER -g $SENSOR_GROUP -L 
/nsm/sensor_data/$SENSOR/sancp/ -b \"$BPF\"" 
"$PROCESS_PID_DIR/$SENSOR/prads.pid" "$PROCESS_LOG_DIR/$SENSOR/prads.log" 
"prads (sessions/assets)"
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "yes" ] && [ "$SANCP_AGENT_ENABLED" == "no" ]  && 
process_start "prads" "-i $SENSOR_INTERFACE_SHORT -c 
/etc/nsm/$SENSOR/prads.conf -u $SENSOR_USER -g $SENSOR_GROUP -f 
/nsm/sensor_data/$SENSOR/pads.fifo $PADS_OPTIONS -b \"$BPF\"" 
"$PROCESS_PID_DIR/$SENSOR/prads.pid" "$PROCESS_LOG_DIR/$SENSOR/prads.log" 
"prads (sessions/assets)"
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "no" ]  && [ "$SANCP_AGENT_ENABLED" == "no" ]  && 
echo_error_msg 1 "Warning: PRADS is enabled but will not start because both 
SANCP AGENT and PADS AGENT are disabled!"

Also updated nsm_sensor_ps-restart similarly.

Original comment by doug.bu...@gmail.com on 27 Dec 2013 at 12:46

  • Added labels: ****
  • Removed labels: ****

GoogleCodeExporter commented Mar 24, 2015 

Updated nsm_sensor_ps-start as follows:
-        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && process_start 
"prads" "-i $SENSOR_INTERFACE_SHORT -c /etc/nsm/$SENSOR/prads.conf -u 
$SENSOR_USER -g $SENSOR_GROUP -L /nsm/sensor_data/$SENSOR/sancp/ -f 
/nsm/sensor_data/$SENSOR/pads.fifo $PADS_OPTIONS -b \"$BPF\"" 
"$PROCESS_PID_DIR/$SENSOR/prads.pid" "$PROCESS_LOG_DIR/$SENSOR/prads.log" 
"prads (sessions/assets)"
+
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "yes" ] && [ "$SANCP_AGENT_ENABLED" == "yes" ] && 
process_start "prads" "-i $SENSOR_INTERFACE_SHORT -c 
/etc/nsm/$SENSOR/prads.conf -u $SENSOR_USER -g $SENSOR_GROUP -L 
/nsm/sensor_data/$SENSOR/sancp/ -f /nsm/sensor_data/$SENSOR/pads.fifo 
$PADS_OPTIONS -b \"$BPF\"" "$PROCESS_PID_DIR/$SENSOR/prads.pid" 
"$PROCESS_LOG_DIR/$SENSOR/prads.log" "prads (sessions/assets)"
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "no" ]  && [ "$SANCP_AGENT_ENABLED" == "yes" ] && 
process_start "prads" "-i $SENSOR_INTERFACE_SHORT -c 
/etc/nsm/$SENSOR/prads.conf -u $SENSOR_USER -g $SENSOR_GROUP -L 
/nsm/sensor_data/$SENSOR/sancp/ -b \"$BPF\"" 
"$PROCESS_PID_DIR/$SENSOR/prads.pid" "$PROCESS_LOG_DIR/$SENSOR/prads.log" 
"prads (sessions/assets)"
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "yes" ] && [ "$SANCP_AGENT_ENABLED" == "no" ]  && 
process_start "prads" "-i $SENSOR_INTERFACE_SHORT -c 
/etc/nsm/$SENSOR/prads.conf -u $SENSOR_USER -g $SENSOR_GROUP -f 
/nsm/sensor_data/$SENSOR/pads.fifo $PADS_OPTIONS -b \"$BPF\"" 
"$PROCESS_PID_DIR/$SENSOR/prads.pid" "$PROCESS_LOG_DIR/$SENSOR/prads.log" 
"prads (sessions/assets)"
+        [ "$PRADS_ENABLED" == "yes" ] && [ -z "$SKIP_PRADS" ] && [ 
"$PADS_AGENT_ENABLED" == "no" ]  && [ "$SANCP_AGENT_ENABLED" == "no" ]  && 
echo_error_msg 1 "Warning: PRADS is enabled but will not start because both 
SANCP AGENT and PADS AGENT are disabled!"

Also updated nsm_sensor_ps-restart similarly.

Original comment by doug.bu...@gmail.com on 27 Dec 2013 at 12:46

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Show comment
Hide comment
@GoogleCodeExporter

GoogleCodeExporter Mar 24, 2015 

Published:
http://blog.securityonion.net/2013/12/new-nsm-and-setup-packages-available.html

Original comment by doug.bu...@gmail.com on 31 Dec 2013 at 12:06

  • Changed state: Verified
  • Added labels: ****
  • Removed labels: ****

GoogleCodeExporter commented Mar 24, 2015 

Published:
http://blog.securityonion.net/2013/12/new-nsm-and-setup-packages-available.html

Original comment by doug.bu...@gmail.com on 31 Dec 2013 at 12:06

  • Changed state: Verified
  • Added labels: ****
  • Removed labels: ****

@GoogleCodeExporter GoogleCodeExporter added Priority-Medium Type-Defect auto-migrated labels Mar 24, 2015

@GoogleCodeExporter GoogleCodeExporter closed this Mar 24, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment