Re: [Sguil-users] Barnyard Wants To Connect on 7735?
Status: Beta
Brought to you by:
bamm
From: Petersen, M. <MPe...@gs...> - 2007-09-25 20:42:43
|
I don't need anyone to blame it, but thanks, this did fix the problem. Mark > -----Original Message----- > From: David J. Bianco [mailto:da...@vo...] > Sent: Monday, September 24, 2007 11:45 AM > To: sgu...@li...; Petersen, Mark > Subject: Re: [Sguil-users] Barnyard Wants To Connect on 7735? >=20 > I think the problem is very simple, and you can blame it on me if you > like. I left out a comma in the HOWTO. Your by config file should > read: >=20 > output sguil: sensor_name sensor, agent_port 7740 >=20 > Note the new comma between "sensor" and "agent_port". I've corrected this > in the latest version of the HOWTO. >=20 > Sorry about that. >=20 > David >=20 > Petersen, Mark wrote: > > Hello, > > > > I've been using sguil for awhile now, quite happy with the results. > > I've had no real problems in the past either. Now I have a new system > > that will have more than one sensor and I'm getting an error from > > barnyard. > > > > snipped configs > > > > Sensor_agent-host-sensor.conf > > > > # Port sguild listens on for sensor connects > > set SERVER_PORT 7736 > > # Port sensor_agent lisens on for barnyard connects > > set BY_PORT 7740 > > > > barnyard-host-sensor.conf > > > > output sguil: sensor_name sensor agent_port 7740 > > > > but barnyard is logging: > > > > Sep 24 11:13:15 qasensor barnyard[6766]: Cannot connect to localhost on > > TCP port 7735. > > Sep 24 11:13:15 qasensor barnyard[6766]: Waiting 15 secs to try again. > > > > I've looked all over for any reference to 7735 (it is the default port > > though) in the configs for both and can not find it. Any advice on > > where to look for what's going wrong? I followed all the directions in > > the instantnms, but I wonder if I missed a necessary step for systems > > with multiple sensors possibly? Also, sguil doesn't see barnyard as > > connected for this sensor. > > > > Thanks, > > mark > > > > > > > > ------------------------------------------------------------------------ > - > > This SF.net email is sponsored by: Microsoft > > Defy all challenges. Microsoft(R) Visual Studio 2005. > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ > > _______________________________________________ > > Sguil-users mailing list > > Sgu...@li... > > https://lists.sourceforge.net/lists/listinfo/sguil-users |