Migrating a Sguil server from 0.6.1 to 0.7.0 (CVS)

Wed, 04 Jul 2007 21:10:36 +0000

Today I finally restored my server that used to host my blog, mail server and sguil server. The sguil server was still at 0.6.1 so this was a good time to see how a migration procedure would work (the earlier 0.7.0 test were done with a newly setup server). I haven’t been able to find documentation about this procedure, but it looks very straightforward, so I think I did it all right.

Sguil 0.7 CVS installation on Debian Etch

Tue, 12 Jun 2007 21:58:51 +0000

Sguil 0.7 is getting shape quite nicely. One of the most interesting new features is the splitting up of different types of agents and the option to create ’net groups’. This are groups of agents that Sguil considers part of the same network. You can use this to spread the agents over multiple servers, but still use it from Sguil as if it was one single sensor. For example, this way you can easily create a Snort sensor and a separate full content logging capture server. When you request the full content for a Snort event in Sguil, it will know that it needs to request the packet data from the capture server. This way you can also have multiple Snort agents without the need for capturing the same sancp and full content data over and over again.

Server on Inliniac

Migrating a Sguil server from 0.6.1 to 0.7.0 (CVS)

Sguil 0.7 CVS installation on Debian Etch