[Bro] Bro hanging on some sensors

Kellogg, Brian D (OLN) bkellogg at dresser-rand.com
Tue Jun 24 14:08:38 PDT 2014

Can you point me in the direction to start looking at this myself?  I'll see what I can dig around and find, thanks.

From: Seth Hall [seth at icir.org]
Sent: Tuesday, June 24, 2014 4:51 PM
To: Kellogg, Brian D (OLN)
Cc: Doug Burks; bro
Subject: Re: [Bro] Bro hanging on some sensors

On Jun 21, 2014, at 6:54 PM, Kellogg, Brian D (OLN) <bkellogg at dresser-rand.com> wrote:

> So far, the most reliable way of getting an intel file loaded is by commenting out apt1 and only enabling one intel file.
I suspect what's going on is some sort of resource overload issue right at Bro startup and that's causing some other "downstream" stuff to fail.  If I get a chance sometime I may write a new script for you to load intelligence with so that it never tries to load more than one intel file at a time. (or someone else could write that!)

Thanks for reporting the issue.  Hopefully we can figure it out together. ;)


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list