prelude-manager(1)

💖 prelude-manager(1) — the General Commands Manual page, but make it cute 💖

Okay bestie, gather round, because this is the manual page for prelude-manager, and it lives in the General Commands Manual section (that's section 1, iykyk). She's a whole server and she's iconic. Let's get into it. 🫶

---

✨ NAME ✨

prelude-manager — collects and normalizes events. That's the whole job description. Short. Powerful. Main character energy. 💅

---

🌸 SYNOPSIS 🌸

prelude-manager [options]

That's it. That's the vibe check. She takes options, periodt. ✨

---

🦋 DESCRIPTION 🦋

Okay so Prelude Manager is a high-availability server, and no, that's not me being dramatic, that's literally what she is. She can:

• collect events 🍓
• filter events 🌈
• relay events 💌
• reverse-relay events 🔁
• normalize events ✨
• store events 💾

And where do all these events come from, you ask? From registered analyzers and/or managers. Bestie, it's a whole social network of events and she is the group chat admin. 👑

The common usage (the everyday slay) is to store nomalized events into a database. But plot twist — this can be extended to store information in plain text or xml files too. Versatile queen. 🎀

---

💅 OPTIONS 💅

Heads up, bestie: some prelude-manager options are contextual — meaning they have to be prefixed by another option. They don't just show up alone, they arrive with their entourage. Don't @ me, that's just how it is. 😭

• --prelude — the Prelude generic options. Everything below this is contextual and rides along with her:
  • --profile=<name> — the profile to use for this analyzer 🌸
  • --heartbeat-interval=<interval> — number of seconds between two heartbeats 💓 (yes, she has a pulse)
  • --server-addr=<address> — the address where this sensor should report to, as addr:port 📍
  • --analyzer-name=<name> — the name for this analyzer 🏷️
• --db=<INAME> — options for the libpreludedb plugin 🗄️
  • -t, --type=<type> — type of database (mysql/pgsql/sqlite3)
  • -l, --log=<file name> — log all queries into a file. > ⚠️ Bestie, this should only be used for debugging purposes, fr fr, don't leave it on.
  • -h, --host=<address> — the host where the database server is running (in the case of a client/server database)
  • -f, --file=<file name> — the file where the database is stored (in the case of a file based database)
  • -p, --port=<port number> — the port where the database server is listening (in the case of a client/server database)
  • -d, --name=<name> — the name of the database where the alerts will be stored
  • -u, --user=<user> — user of the database (in the case of a client/server database)
  • -P, --pass=<password> — password for the user (in the case of a client/server database) 🔐
• --debug=<INAME> — option for the debug plugin 🐛
  • -o, --object=<name> — name of the IDMEF object to print (if no object is provided, it will print the entire message) 📨
  • -l, --logfile=<file name> — specify the output file to use (defaults to stdout)
• --relaying=<INAME> — relaying plugin option 💌
  • -p, --parent-managers=<address> — list of managers address:port pairs where messages should be sent to
• --textmod=<INAME> — option for the textmod plugin 📝
  • -l, --logfile=<file name> — specify the logfile to use
• --xmlmod=<INAME> — option for the xmlmod plugin 🧚
  • -l, --logfile=<file name> — specify the output file to use
  • -v, --validate=<xml> — validate IDMEF XML output against DTD ✅
  • -f, --format=<format> — format XML output so that it is readable (we love a legible king) 👑
  • -d, --disable-buffering=<boolean> — disable output file buffering to prevent truncated tags ✂️
  • --idmef-criteria-filter=<INAME> — filter messages based on IDMEF criteria 🔍
    • -r, --rule=<rule> — filter rule, or a filename containing a rule 📜
  • --hook=<value> — where the filter should be hooked (reporting|reverse-relaying|plugin name) 🪝
• --config=<file name> — configuration file to use ⚙️
• -v, --version — print version number 📌
• -D, --debug-level=<level> — run in debug mode 🐞
• -d, --daemon — run in daemon mode 👻
• -P, --pidfile=<file name> — write the Prelude PID to the pidfile 🆔
• -c, --child-managers=<address> — list of managers address:port pairs where messages should be gathered from 🧺
• -l, --listen=<address> — address the sensors server should listen on, as addr:port 👂
• -f, --failover=<boolean> — enable failover for the specified report plugin 🛟
• -h, --help — print help 🆘

---

📁 FILES 📁

• /etc/prelude/prelude-manager.conf — the configuration file 🌷

---

💀 BUGS 💀

This man page hadn't been proof-read yet. 😭 Not me exposing the whole team like this. Anyway. It is what it is. 🙈

---

🌈 SEE ALSO 🌈

• prelude-adduser(1) — go check on her too, she's part of the lore 🫶

---

And that's the whole page, bestie! This was the prelude-manager page from the General Commands Manual, and that little prelude-manager(1) sitting at the very bottom? That's just the manual name stamping her name one more time on the way out, like signing off a text with her own name because she's that girl. 💖 Stay hydrated, read your man pages, and remember: normalize your events, not your feelings. 🎀✨