Running reports stops correlation
6 views
Skip to first unread message
Joey
Jul 26, 2007, 9:15:02 AM7/26/07
to Aanval - Snort & Syslog > Intrusion and Correlation Console
I have build 30164. Simply, everytime I run a report Aanval stops
processing events. I have not found a way to change this except to
reset the store and reload Aanval. After the complete cleanup I ran a
canned Yesterdays High Risk Events and watched as processorB went red
and waited and it went green after a few hours. But then no new
events were added to the correlation. Additionally the Host Matching
never returns any hosts, it rmains on matching 0.0.0.0 to 0.0.0.0.
processing events. I have not found a way to change this except to
reset the store and reload Aanval. After the complete cleanup I ran a
canned Yesterdays High Risk Events and watched as processorB went red
and waited and it went green after a few hours. But then no new
events were added to the correlation. Additionally the Host Matching
never returns any hosts, it rmains on matching 0.0.0.0 to 0.0.0.0.
Any suggestions?
Reply all
Reply to author
Forward
0 new messages