On Wed, 2008-11-12 at 11:16 -0500, Dan Gruhn wrote: I have used this procedure for 1.7.7 and soon 1.7.9. I believe it is up to date. I assume you want to point all machines to just one which will display the prewikka info? If that is the case you will need to register the audit senders to the single prelude-manager which isn't detailed exactly on those instructions (last I looked). However, it is easy. Just follow the instructions for single server and then register the non-prewikka machines to the main collector. I register the audit prelude sensor with the prelude-manager on each host. Then I register the prelude-manager to the prelude-manager on the Prelude Collector/Server (set the "parent-managers" option in /etc/prelude-manager/prelude-manager.conf. Here are some example instructions for the above. Edit /etc/prelude-manager/prelude-manager.conf * Locate and uncomment the [relaying] section * Add parent-managers = <prelude server IP> Register the prelude-manager with the Prelude Server's prelude-manager : * Run prelude-admin register prelude-manager "idmef:w" <prelude server IP> --uid 0 --gid 0 * Open a second terminal window and ssh <prelude server IP> * On the Prelude Server, run: prelude-admin registration-server prelude-manager * The Prelude Server will generate a one time password. You will need to copy and paste the password to the first window when it prompts for the password. * Confirm the password * Acknowledge the registration in the Prelude Server terminal window. LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com