psad: pid file /var/run/psad/psadwatchd.pid does not exist for psadwatchd on ...

[mbit]

Hi,
I followed your guide and ran into the following problem when using psad -R :

/etc/psad# ufw reload
Firewall reloaded
root@server:/etc/psad# psad -R
[-] psad: pid file /var/run/psad/psadwatchd.pid does not exist for psadwatchd on server
[+] Stopping psad, pid: 1491
[+] Stopping psad_fw_read, pid: 1492
[+] Restarting psad daemons on

[mbit]

This helped: https://carteryagemann.com/psad-on-pi.html
But when using psad -H it still says [-] psadwatchd daemon not running.

[IMTheNachoMan]

So it looks like you have to set another setting for psadwatchd to start. I will update the guide.

[Jonathan Guzman Guadarrama]

This helped: https://carteryagemann.com/psad-on-pi.html
But when using psad -H it still says [-] psadwatchd daemon not running.

in the config file adding (/etc/psad/psad.conf):
ENABLE_PSADWATCHD Y;
and then follow the instructions at https://carteryagemann.com/psad-on-pi.html
worked for me

[IMTheNachoMan]

Yup. I added the ENABLE_PSADWATCHD thing to my guide.

[Fax O'Therapy]

HIi, I'm still having the “psad: psadwatchd is not running on” after I added “ENABLE_PSADWATCHD Y;” and followed the above guide.

I also correctly added this in before.rules:

# log all traffic so psad can analyze
-A INPUT -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
-A FORWARD -j LOG --log-tcp-options --log-prefix "[IPTABLES] "

However, I still see:

psad --fw-analyze
[+] Parsing INPUT chain rules.
[+] Parsing INPUT chain rules.
[-] Errors found in firewall config.
    emailed to root@localhost
[+] Results in /var/log/psad/fw_check
[+] Exiting.

Mail shows:

You may just need to add a default logging rule to the 'filter' 'INPUT' chain on

I'm not good with iptables.

[Fax O'Therapy]

I'm still having the “psad: psadwatchd is not running on” after I added “ENABLE_PSADWATCHD Y;”

psadwatchd does indeed start and run, but stops running after a few seconds. Is it expected?

psad --fw-analyze
[+] Parsing INPUT chain rules.
[+] Parsing INPUT chain rules.
[-] Errors found in firewall config.
emailed to root@localhost
[+] Results in /var/log/psad/fw_check
[+] Exiting.

This is due to the fact I set IPV6 to no in /etc/default/ufw file.