Techapp112:/usr/local/bin # ps aux | grep agent
jed1289 11413 0.0 0.0 4888 2376 pts/0 T 06:13 0:00 vi sensor_agent.conf
root 11688 0.0 0.0 2988 1512 pts/0 S 06:19 0:00 tclsh /usr/local/bin/sguil/sensor/sensor_agent.tcl -c /usr/local/etc/nsm/sensor_agent.conf
root 11800 0.0 0.0 2752 700 pts/0 S+ 06:23 0:00 grep agent
Techapp112:/usr/local/bin #
Techapp112:/usr/local/etc/nsm # vi sensor_agent.conf
# $Id: sensor_agent.conf,v 1.7 2006/02/08 06:23:19 bamm Exp $ #
#
# Configuration file for sensor_agent.tcl - http://sguil.sf.net
#
# DEBUG is VERY chatty. Use it only when needed.
# 1=on 0=off
set DEBUG 0
# Run in background
# 1=yes 0=no
set DAEMON 1
# Name of sguild server
set SERVER_HOST 172.21.9.252
# Port sguild listens on for sensor connects
set SERVER_PORT 7736
# Port sensor_agent lisens on for barnyard connects
set BY_PORT 7735
# Local hostname - that means this machines name
# Note: Sensors monitoring multiple interfaces need to use a unique 'hostname'
# for each interface. Make sure this name is the same in the respective
# log_packets.sh
set HOSTNAME nsmlms
# The root of your log dir for data like pcap, portscans, sessions, etc
set LOG_DIR /nsm
# Where to look for files created by modded spp_portscan
set PORTSCAN_DIR ${LOG_DIR}/${HOSTNAME}/portscans
#
# Xscriptd functions moved here
#
# Where raw/pcap files are being logged to and will be read from.
# (see -l in log_packets.sh)
set RAW_LOG_DIR ${LOG_DIR}/${HOSTNAME}/dailylogs
# Path to tcpdump. Used for parsing pcap files.
set TCPDUMP "/usr/sbin/tcpdump"
# If you do VLAN tagging then set this to 1 so the right filter is passed to tcpdump.
set VLAN 0
# Directory to store the temp pcap files