[Bro] can not start bro
r.fulton at auckland.ac.nz
Fri Jun 27 00:20:27 PDT 2014
On 27/06/2014, at 6:46 pm, Daniel Thayer <dnthayer at illinois.edu> wrote:
> You probably forgot to run "broctl install”.
I’m an idiot! but it would be nice if broctl start did some sanity checking!
I manage my sensors with puppet — I need to add and exec to run broctl install if the bro-spool/installed-scripts… does not exist after the config files are put in place.
> On 06/26/2014 11:42 PM, Russell Fulton wrote:
>> I had a series of problems on one sensor (disk full and consequent issues) and now when I try
>> broctl start
>> it tries to start the manager and just hangs.
>> rful011 at secmontst01:/opt/bro/etc$ sudo broctl start
>> warning: removing stale lock
>> starting manager …
>> after killing it I find:
>> rful011 at secmontst01:/opt/bro/etc$ cat ~sensors/data/dmzo/bro-spool/manager/stderr.log
>> nohup: failed to run command `/run-bro': No such file or directory
>> timestamp is current.
>> Bro is installed using securityoinion-bro — I have tried removing and installing it again but it does not make any difference.
>> Any ideas on what to look for.
More information about the Bro