how can i know if i am using standalone or server/sensor

[olive]

i had installed and configured security onion but i forgot if am choosing standalone or server/sensor and if is possible to change all configuration after setup
thanks .

[Wes Lambert]

Hi Olive,

Check /etc/nsm/servertab and sensortab to see which components are enabled.

Or you can run so-status to see the running services

You can re-configure by re-running sosetup.

Thanks,

Wes

On Thu, Jun 21, 2018 at 6:40 AM olive <ossam...@gmail.com> wrote:

i had installed and configured security onion but i forgot if am choosing standalone or server/sensor and if is possible to change all configuration after setup
thanks .

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

--

https://twitter.com/therealwlambert

https://securityonion.net/

[bz Os]

thanks Wes for reply, this is the /etc/nsm/servertab :# The server table is used as a quick look up for the NSMnow administration

# scripts. Each line represents a unique server on this host (due to the current limitations of sguil, this is restricted to 1). The values defined

# are:

#   - name: the name of the server

#   - auto: the server is capable of auto assumption

#

# name auto

securityonion 1

[Erwin]

Hi Olive,

you can check if the file exists in the directory, on a standalone you have servertab and sensortab.

on a sensor you have only sensortab.

regards,
erwin

[olive]

[bz Os]

thanks erwin ,i am using standalone but i have a problem snort not send logs to sguil