I have been trying to make existing SNORT (on backtrack) work on OSSIM. Through the iso image, I installed 3 components of OSSIM ( Server, framwork & DB) in the first machine. Then T tried to install ossim-agent in other machine (backtrack) in the same network, in order to use snort as an existing feature on backtrack. And now, i'm trying tirelessly to force the agent to communicate with the server. On the client side, I followed the steps listed below to my snort machine :
- I copied the following directories:
/etc/ossim/agent/ + /usr/share/ossim-agent and the file /usr/bin/ossim-agent
when i check on ??? snort_syslog=/etc/ossim/agent/plugins/snort_syslog.cfg location: /var/log/%(process)s/alert ??? snortunified_eth0=/etc/ossim/agent/plugins/snortunified_eth0.cfg directory : /var/log/snort ???
On the serverside: I activated Snort sensor in ossim-setup, finally when i execute the following command:
# ossim-agent -f -d -c -v /etc/ossim/agent/config.cfg or even ossim-agent -d I get the following message : usr/share/ossim-agent/ossim_agent/ParserUtil.py:35: DeprecationWarning: the md5 module is deprecated; use hashlib instead import md5 Traceback (most recent call last): File "/usr/bin/ossim-agent", line 7, in <module> from ossim_agent.Agent import Agent File "/usr/share/ossim-agent/ossim_agent/Agent.py", line 46, in <module> from ParserLog import ParserLog File "/usr/share/ossim-agent/ossim_agent/ParserLog.py", line 37, in <module> import pyinotify #deb package python-pyinotify ImportError: No module named pyinotify
Is the followed steps are the righ ones?II there any missed configuration?How can I make this agent work?Please advise me with any indication that might be helpfull. Thank you