Techapp112:/usr/local/bin # ps aux | grep agent
jed1289  11413  0.0  0.0   4888  2376 pts/0    T    06:13   0:00 vi sensor_agent.conf
root     11688  0.0  0.0   2988  1512 pts/0    S    06:19   0:00 tclsh /usr/local/bin/sguil/sensor/sensor_agent.tcl -c /usr/local/etc/nsm/sensor_agent.conf
root     11800  0.0  0.0   2752   700 pts/0    S+   06:23   0:00 grep agent
Techapp112:/usr/local/bin #

Techapp112:/usr/local/etc/nsm # vi sensor_agent.conf
# $Id: sensor_agent.conf,v 1.7 2006/02/08 06:23:19 bamm Exp $ #

#
# Configuration file for sensor_agent.tcl - http://sguil.sf.net
#

# DEBUG is VERY chatty. Use it only when needed.
# 1=on 0=off
set DEBUG 0

# Run in background
# 1=yes 0=no
set DAEMON 1

# Name of sguild server
set SERVER_HOST 172.21.9.252
# Port sguild listens on for sensor connects
set SERVER_PORT 7736
# Port sensor_agent lisens on for barnyard connects
set BY_PORT 7735
# Local hostname - that means this machines name
# Note: Sensors monitoring multiple interfaces need to use a unique 'hostname'
#       for each interface. Make sure this name is the same in the respective
#       log_packets.sh
set HOSTNAME nsmlms

# The root of your log dir for data like pcap, portscans, sessions, etc
set LOG_DIR /nsm

# Where to look for files created by modded spp_portscan
set PORTSCAN_DIR ${LOG_DIR}/${HOSTNAME}/portscans

#
# Xscriptd functions moved here
#
# Where raw/pcap files are being logged to and will be read from.
# (see -l in log_packets.sh)
set RAW_LOG_DIR ${LOG_DIR}/${HOSTNAME}/dailylogs
# Path to tcpdump. Used for parsing pcap files.
set TCPDUMP "/usr/sbin/tcpdump"
# If you do VLAN tagging then set this to 1 so the right filter is passed to tcpdump.
set VLAN 0
# Directory to store the temp pcap files