Alien Vault Events Not Coming

Some of the options that can be pursued to troubleshoot and resolve this issue have been mentioned below:

  • Login to Alien Vault server using putty with “root” credentials.
  • After login, you will see the following screen.
  • Select the “Jailbreak System”
  • Click “Yes” or Press “Enter” from the keyboard and accept the “Jailbreak Commandline Notice” in next screen by clicking “Yes:”

This will give you a command line access to Alien Vault server and screen will be displayed as below.

Run the following command in the console and wait for this to complete.

Command: /etc/init.d/ossim-agent restart

If the above command ran successfully, wait for at least 5 minutes and refresh the Alien Vault Alarms page in browser.

If something is still wrong and you don’t see the alerts in the web GUI, then we need to pivot and try some other method. The next suggested step is a bit too much at this stage but will get you through the task. Click Here for the Event Level Troubleshooting or here for OSSIM agent troubleshoot if alarms are not coming.

Leave a Reply

Your email address will not be published. Required fields are marked *