-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Open
Description
I'm not the best w/ admin-y stuff, so maybe I just did something wrong - but after running the Ansible playbook, if I re-run it (causing the psad.service to be restarted), then I get a whole host of e-mail spam about psadwatch warning me that it can't start psad:
However, according to sysctl, it's indeed running happily;
root@berit-the-vc2-4c-8gb:/home/ec# service psad status
● psad.service - Port Scan Attack Detector (psad)
Loaded: loaded (/lib/systemd/system/psad.service; enabled; preset: enabled)
Active: active (running) since Sun 2025-02-09 15:44:47 UTC; 9min ago
Docs: man:psad
Process: 125305 ExecStart=/usr/sbin/psad $DAEMON_ARGS (code=exited, status=0/SUCCESS)
Main PID: 125332 (psad)
Tasks: 3 (limit: 9467)
Memory: 25.4M
CPU: 44.973s
CGroup: /system.slice/psad.service
├─125332 /usr/bin/perl -w /usr/sbin/psad
├─125353 /usr/bin/perl -w /usr/sbin/psad
└─125354 /bin/journalctl -f -k
root@berit-the-vc2-4c-8gb:/home/ec# psad -S
[+] psad_fw_read (pid: 125353) %CPU: 0.0 %MEM: 0.2
Running since: Sun Feb 9 15:44:47 2025
[+] psad (pid: 125332) %CPU: 1.0 %MEM: 0.2
Running since: Sun Feb 9 15:44:47 2025
Command line arguments: [none specified]
Alert email address(es): [email protected]
[+] Version: psad v2.4.6
root@berit-the-vc2-4c-8gb:/home/ec# ps aux | grep psad
root 125332 1.0 0.2 29368 23168 ? Ss 15:44 0:07 /usr/bin/perl -w /usr/sbin/psad
root 125353 0.0 0.2 28764 19532 ? S 15:44 0:00 /usr/bin/perl -w /usr/sbin/psadSince the Debian service manages the psad process, does that mean we should disable the psadwatch option that was enabled in #61? Or is there some other way to get them to play nice with eachother?
Metadata
Metadata
Assignees
Labels
No labels