[Bro] Just getting started

Castle, Shane scastle at bouldercounty.org
Wed Jan 9 11:28:08 PST 2013

You must use sudo: "sudo broctl check". Followed by rinse, spin (install, restart). ;)

Unless you're already root.

That message is the result I always get when I forget sudo.

Shane Castle
Data Security Mgr, Boulder County IT

-----Original Message-----
From: bro-bounces at bro-ids.org [mailto:bro-bounces at bro-ids.org] On Behalf Of Paul Schmehl
Sent: Wednesday, January 09, 2013 12:03
To: Bro List
Subject: [Bro] Just getting started

I just installed Bro (on FreeBSD 8.3) and got it up and running. I'm 
working my way through the docs, and I decided to do the local.bro edit for 
the Invalid SSL Certs that's described in the docs.

However, when I launched broctl and typed check, I got this:  waiting for 
lock ..................................cannot get lock

I got the same thing when I typed stop as well as diag.

When I started broctl initially, I typed "install" and then "start".  Then 
I closed broctl.  Apparently you're supposed to leave broctl running?  If 
so, that seems rather inconvenient.

Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell

Bro mailing list
bro at bro-ids.org

More information about the Bro mailing list