Skip to content

Some sort of conflict between psadwatch and the default Debian psad service? #125

@ELLIOTTCABLE

Description

@ELLIOTTCABLE

I'm not the best w/ admin-y stuff, so maybe I just did something wrong - but after running the Ansible playbook, if I re-run it (causing the psad.service to be restarted), then I get a whole host of e-mail spam about psadwatch warning me that it can't start psad:

Image

However, according to sysctl, it's indeed running happily;

root@berit-the-vc2-4c-8gb:/home/ec# service psad status
● psad.service - Port Scan Attack Detector (psad)
     Loaded: loaded (/lib/systemd/system/psad.service; enabled; preset: enabled)
     Active: active (running) since Sun 2025-02-09 15:44:47 UTC; 9min ago
       Docs: man:psad
    Process: 125305 ExecStart=/usr/sbin/psad $DAEMON_ARGS (code=exited, status=0/SUCCESS)
   Main PID: 125332 (psad)
      Tasks: 3 (limit: 9467)
     Memory: 25.4M
        CPU: 44.973s
     CGroup: /system.slice/psad.service
             ├─125332 /usr/bin/perl -w /usr/sbin/psad
             ├─125353 /usr/bin/perl -w /usr/sbin/psad
             └─125354 /bin/journalctl -f -k

root@berit-the-vc2-4c-8gb:/home/ec# psad -S
[+] psad_fw_read (pid: 125353)  %CPU: 0.0  %MEM: 0.2
    Running since: Sun Feb  9 15:44:47 2025

[+] psad (pid: 125332)  %CPU: 1.0  %MEM: 0.2
    Running since: Sun Feb  9 15:44:47 2025
    Command line arguments: [none specified]
    Alert email address(es): [email protected]

[+] Version: psad v2.4.6

root@berit-the-vc2-4c-8gb:/home/ec# ps aux | grep psad
root      125332  1.0  0.2  29368 23168 ?        Ss   15:44   0:07 /usr/bin/perl -w /usr/sbin/psad
root      125353  0.0  0.2  28764 19532 ?        S    15:44   0:00 /usr/bin/perl -w /usr/sbin/psad

Since the Debian service manages the psad process, does that mean we should disable the psadwatch option that was enabled in #61? Or is there some other way to get them to play nice with eachother?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions