Samhain | ||
---|---|---|
<<< Previous | FAQ — Frequently Asked Questions | Next >>> |
![]() | TIP |
---|---|
The most frequent reason for client/server connection problems is the following: The server must be able to determine the client name. This is because only authenticated connections from registered clients are allowed, and the server must be able to check the client hostname against the list of allowed hosts, and look up the password verifier for that host. There are two different ways to accomplish this. Unfortunately, judging from customer feedback as well from common sense, both do not work very well with a messed up local DNS (including /etc/hosts files) and/or überparanoid or misconfigured firewalls (in case of connections across one).
|
See the tip above.
See the tip above.
See the tip above (obj is the IP to which the peer name should resolve).
See the tip above.
In the server config file, you have not listed the client. Or you have listed it, but not with the correct name. The name to use is the one the client has determined for the host it is running on, and is given in the error message. This error frequently occurs if you have listed the client with a FQDN in the server config file, while the client itself can only determine the IP address of its host (usually caused by improper entries in /etc/hosts).
The respective client for that this message is generated has not sent anything for some interval of time (default 84600 sec = 1 day). The interval can be set in section [Misc] with SetClientTimeLimit=NNN. This feature has the purpose to detect if a client is dead. You might want to ensure that timestamps are sent to the server (in [Log]: ExportSeverity=mark). If you don't want to use this feature, set the time limit to some very large value.
Most likely, the client password (set in the binary via the samhain_setpwd utility) does not match the credentials in the server config file.
In the Database section of the configuration file, you can put an option SetDBServerTstamp=true/false This will enable/disable logging of the server timestamp for client messages. The server timestamp will be written to a seperate record, with log_ref set to the value of log_index of the corresponding client message. See also the Section called SQL Database in the chapter called Configuration — Basic>.
Sending timestamps from the client allows the server to detect if a client is not running anymore (use SetClientTimeLimit=NNN in the [Misc] section of the server config file to set the number of seconds after which the server will issue an error message if no timestamp has been received).
However, you might not want to log these timestamps to the database (or other log facilities). To filter them, you can use two methods (examples are for the SQL database). The first one has the disadvantage that only messages of severity err or higher will be logged:
[Misc] UseClientSeverity=yes [Log] DatabaseSeverity=err |
The second method is more specific — log everything not belonging to the STAMP class of messages (see the Section called Classes in the chapter called Configuration — Basic>):
[Misc] UseClientClass=yes [Log] DatabaseClass=PANIC RUN FIL TCP ERR ENET EINPUT |
The server cannot bind to its port because the port is already used. Maybe you have accidentially already an instance of the server running.
<<< Previous | Home | Next >>> |
Client or Standalone | Up | MySQL/PostgreSQL Database |