9. Prelude
Prev Chapter 4. Configuration of logging facilities Next

9. Prelude

[Note]REQUIREMENTS

This facility requires that you have compiled with the --with-prelude option to include support for prelude. Of course you need the libprelude client library for this to work.

[Note]Note

The following configuration options can only be used. They should be placed the [Misc] section of the configuration file, if you use them. The 'PreludeMapTo...' options do not affect in any way whether a message is reported by samhain to the prelude manager (for this there is 'PreludeSeverity' in the [Log] section); they only affect the 'Impact severity' shown on the prelude side.

PreludeProfile

PreludeProfile= profile_name

Specify the profile to use. The default is 'samhain'.

PreludeMapToInfo

PreludeMapToInfo= list of samhain severities

The severities that should be mapped to impact severity 'info' for prelude. (default: none).

PreludeMapToLow

PreludeMapToInfo= list of samhain severities

The severities that should be mapped to impact severity 'low' for prelude. (default: debug, info).

PreludeMapToMedium

PreludeMapToMedium= list of samhain severities

The severities that should be mapped to impact severity 'medium' for prelude. (default: notice, warn, err).

PreludeMapToHigh

PreludeMapToHigh= list of samhain severities

The severities that should be mapped to impact severity 'high' for prelude. (default: crit, alert).

9.1. Prelude-specific command-line options

The following prelude-specific command-line options are accepted:

  1. --prelude Prelude generic options are following. This option must be given before the following options are used.

  2. --profile <arg> Profile to use for this analyzer

  3. --heartbeat-interval <arg> Number of seconds between two heartbeats

  4. --server-addr <arg> Address where this sensor should report to (addr:port)

  5. --analyzer-name <arg> Name for this analyzer

9.2. Registering to a Prelude manager

[Tip]Sensor name/profile

The default sensor name/profile is 'samhain'. However, version 2.0.6 of samhain still had 'Samhain' For versions of samhain later than 2.0.6, there is an option PreludeProfile= profile (in the [Misc] section) to set a user-defined name/profile.

In order to register samhain as a Prelude sensor, you need to run on the sensor host and on the manager host the prelude-admin command.

	  sensor # prelude-admin register samhain "idmef:w admin:r" <manager host> \
	  --uid=prelude --gid=prelude

	  You now need to start "prelude-admin" registration-server on 127.0.0.1:
	  example: "prelude-admin registration-server prelude-manager"

	  Enter the one-shot password provided on 127.0.0.1:
	
	  manager # prelude-admin registration-server prelude-manager

	  The "76g4h8au" password will be requested by "prelude-admin register"
	  in order to connect. Please remove the quotes before using it.

	  Generating 1024 bits Diffie-Hellman key for anonymous authentication...
	  Waiting for peers install request on 0.0.0.0:5553...
	  Waiting for peers install request on :::5553...

You now have to type in the one-shot password generated on "manager" at the password prompt on "sensor", (twice, for confirmation). Then on "manager" you will be asked to approve the registration. Type 'y', and you are finished.

The configuration file for the samhain sensor is /etc/prelude/profile/samhain/config

Prev Up Next
8. Console Home 10. Using samhain with nagios