Help with psad

Andy12 · 10-04-2008, 03:53 AM

Hi everyone, i'm currently trying to insall psad via the following url, i've tryed twice and still no luck, if somebody could possibly help find out why, it would be much appreciated. Some details:

Code:

####/home/##### psad -S
[+] psadwatchd (pid: 6316)  %CPU: 0.0  %MEM: 0.1
    Running since: Wed Oct  1 13:40:57 2008

[+] kmsgsd (pid: 6314)  %CPU: 0.0  %MEM: 0.0
    Running since: Wed Oct  1 13:40:57 2008

[+] psad (pid: 6312)  %CPU: 0.0  %MEM: 3.8
    Running since: Wed Oct  1 13:40:57 2008
    Command line arguments: help
    Alert email address(es): ####@gmail.com

    [No scans detected]

    Netfilter prefix counters:
        [NONE]

    Total scan sources: 0
    Total scan destinations: 0

    Total packet counters:

And thats after i have done a port scan from a remote machine,
i am also using the lokkit for my firewall.

unSpawn · 10-06-2008, 01:27 PM

Quote:

Originally Posted by Andy12

Code:

[+] psad (pid: 6312)  %CPU: 0.0  %MEM: 3.8
    Running since: Wed Oct  1 13:40:57 2008
    Command line arguments: help <- does that arg look right?


    Netfilter prefix counters:
        [NONE] <- does 'iptables -n -L' show you've got the appropriate "-j LOG" rules?

Quote:

Originally Posted by Andy12

i am also using the lokkit for my firewall.

Does its ruleset interfere with what PSAD needs? (LOG rules?)