Snortcenter: cant connect localhost:2525

["Guy Marcenac" <guymarc () ifrance com>]

Hello,

My sensors cant connect to miniserv on 2525

In snortcenter/sensor console, sensors are stopped with the following
messages:
"Can't Connect to localhost:2525".
If I try to reconnect (following the link 'Retry reconnecting'), it fails

I have been using snortcenter (very nice snort management GUI) without any
pb

I have a DSL connection which I must restart every night (disconnect,
reconnect).
knowing that the snort process listening ppp0 dies when ppp0 is down, I stop
the sensor, reconnect, then start the sensor.
My batch seems like this:

#stop the ppp0 sensor (internet), using snortcenter
wget "http://localhost:xxxx/snortcenter/sensor.php?sensor_ctl=stop&id=3";

#disconnect - reconnect

#restart the sensor
wget "http://localhost:xxxx/snortcenter/sensor.php?sensor_ctl=start&id=3";

This night, but its not the first time it happens, the reconnect proccess
failled,
so I mannually relaunched this morning

I stopped, started the miniserver program, but nothing seems to change
I can launch manually the snort process, but the snortcenter status doesn't
change.

Any idea ?

my config:
 Snortcenter 0.9.6
 ACID 0.9.6b22 with scheme 106
 snort 1.9.0 (Build 209)
 "redhat 7.3" 2.4.18

netstat results:
tcp        0      0 127.0.0.1:2525          0.0.0.0:*               LISTEN
28585/perl

ps results:
root     28585     1  0 12:49 ?        00:00:00 /usr/bin/perl
/opt/snortagent/sensor/miniserv.pl /etc/snort.snortcenter/miniserv.conf

miniserv.conf:
 port=2525
 bind=localhost
 host=i7k
 addtype_cgi=internal/cgi
 realm=SnortCenter Sensor
 logfile=/var/log/snort/miniserv.log
 pidfile=/var/log/snort/miniserv.pid
 errorlog=/var/log/snort/miniserv.error
 logtime=168
 ssl=0
 env_SENSOR_CONFIG=/etc/snort.snortcenter
 env_SENSOR_VAR=/var/log/snort
 atboot=1
 logout=/etc/snort.snortcenter/logout-flag
 denyfile=\.pl$
 log=1
 blockhost_failures=5
 blockhost_time=60
 passdelay=1
 syslog=1
 allow=localhost
 session=0
 userfile=/etc/snort.snortcenter/sensor.users
 keyfile=/etc/snort.snortcenter/sensor.pem
 root=/opt/snortagent/sensor/cgi

--
guy



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users