Re: [Sguil-users] Barnyard Wants To Connect on 7735?

[Petersen, M. <MPe...@gs...>]

I don't need anyone to blame it, but thanks, this did fix the problem.

Mark

> -----Original Message-----
> From: David J. Bianco [mailto:da...@vo...]
> Sent: Monday, September 24, 2007 11:45 AM
> To: sgu...@li...; Petersen, Mark
> Subject: Re: [Sguil-users] Barnyard Wants To Connect on 7735?
>=20
> I think the problem is very simple, and you can blame it on me if you
> like.  I left out a comma in the HOWTO.  Your by config file should
> read:
>=20
> 	output sguil: sensor_name sensor, agent_port 7740
>=20
> Note the new comma between "sensor" and "agent_port".  I've corrected
this
> in the latest version of the HOWTO.
>=20
> Sorry about that.
>=20
> 	David
>=20
> Petersen, Mark wrote:
> > Hello,
> >
> > I've been using sguil for awhile now, quite happy with the results.
> > I've had no real problems in the past either.  Now I have a new
system
> > that will have more than one sensor and I'm getting an error from
> > barnyard.
> >
> > snipped configs
> >
> > Sensor_agent-host-sensor.conf
> >
> > # Port sguild listens on for sensor connects
> > set SERVER_PORT 7736
> > # Port sensor_agent lisens on for barnyard connects
> > set BY_PORT 7740
> >
> > barnyard-host-sensor.conf
> >
> > output sguil: sensor_name sensor agent_port 7740
> >
> > but barnyard is logging:
> >
> > Sep 24 11:13:15 qasensor barnyard[6766]: Cannot connect to localhost
on
> > TCP port 7735.
> > Sep 24 11:13:15 qasensor barnyard[6766]: Waiting 15 secs to try
again.
> >
> > I've looked all over for any reference to 7735 (it is the default
port
> > though) in the configs for both and can not find it.  Any advice on
> > where to look for what's going wrong?  I followed all the directions
in
> > the instantnms, but I wonder if I missed a necessary step for
systems
> > with multiple sensors possibly?  Also, sguil doesn't see barnyard as
> > connected for this sensor.
> >
> > Thanks,
> > mark
> >
> >
> >
> >
------------------------------------------------------------------------
> -
> > This SF.net email is sponsored by: Microsoft
> > Defy all challenges. Microsoft(R) Visual Studio 2005.
> > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > _______________________________________________
> > Sguil-users mailing list
> > Sgu...@li...
> > https://lists.sourceforge.net/lists/listinfo/sguil-users