Samhain | ||
---|---|---|
<<< Previous | Next >>> |
![]() | TIP |
---|---|
The most frequent problems are:
|
An untrusted user (might be an untrusted group member for group writeable files/directories) owns or can write to an element in the path listed in the error message. This concerns the configuration file, the log file, and the database file.
The offending element in the path is identified as obj=/xxx in the error message.
To fix the problem, determine relevant users and/or group members, and use the configure option --with-trusted=LIST_OF_TRUSTED_UIDS (not GIDS !)
./configure [more options] --with-trusted=0,...
See above
Most likely permission denied because of unsufficient privileges.
If running as daemon, the default output facility is /dev/console. To stop output there, simply set the threshold to 'none'.
[Log] PrintSeverity=none |
Note that depending on your syslog configuration, syslog may also log to /dev/console, if you have enabled logging to syslog in the samhain configuration file (see also the Section called Syslog in the chapter called Configuration — Basic>).
The executable will get stripped during the installation. On suitable systems (i386 Linux/FreeBSD currently), additionally the sstrip utility (copyright 1999 by Brian Raiter, under the GNU GPL) will be used to strip the executable even more, to prevent debugging with the GNU gdb debugger. The strip utility cannot handle the resulting executable, therefore trying to strip manually after installation will corrupt the executable.
If you have compiled for stealth, you won't see much, because if obfuscated, then both a 'normal' and an XML logfile look, well ... obfuscated. Use 'samhain -jL /path/to/logfile' to view the logfile.
Fix your DNS (reverse lookup: numerical IP address to FQDN, to verify FQDN to numerical IP address). If this problem happens for client/server connections: also see the Section called Server>.
First, nslookup does not use the system resolver library — it has its own resolving routines, and does things differently than the resolver library (see the book DNS and bind). Therefore, it is not exactly the best tool for debugging name resolving problems. Second, did you check reverse lookup as well as forward lookup ?
Because /dev/random can block for a long time if there is no entropy, samhain will fall back on /dev/urandom after some timeout, and issue this message (it will try /dev/random again next time).
Set SeverityNames to a low value (see the Section called Severity levels in the chapter called Configuration — Basic>).
Redhat uses initlog (see man initlog) in initscripts. If it hangs, most probably samhain/yule runs in the foreground rather than as daemon. Use Daemon=yes in the configuration file.
Either the program is not installed, or it is not in the PATH (the one used by the init script, which may be different from your PATH).
<<< Previous | Home | Next >>> |
Design | Client or Standalone |