[Bro] Can't load magic file <default> on CentOS 5
Knick, Scott E CTR USARMY RCERT-EUR (US)
scott.e.knick.ctr at mail.mil
Wed May 7 06:57:29 PDT 2014
I did discover a solution based on the following bug report, though I'm still fighting through some other issues.
Basically, you have to also (or rather?) set the MAGIC environment variable, not just the BROMAGIC environment variable.
My conundrum seems to be happening because I need to be able to run on CentOS 5 (or RHEL 5), but that distro is stuck with libmagic version 4, and I can't figure out how to upgrade the system to version 5 without ruining a bunch of things.
From: Mike Kolkebeck [mailto:mkolkebeck at gmail.com]
Sent: Wednesday, May 07, 2014 3:54 PM
To: Knick, Scott E CTR USARMY RCERT-EUR (US)
Cc: bro at bro.org
Subject: Re: [Bro] Can't load magic file <default> on CentOS 5
I've had the same problem when upgrading to libmagic 5.18 (file-5.18), using Bro 2.2.
It worked fine with file-5.16.
Are there any quick fixes out there without having to downgrade?
> On May 7, 2014, at 8:20 AM, "Knick, Scott E CTR USARMY RCERT-EUR (US)" <scott.e.knick.ctr at mail.mil> wrote:
> I've managed to build Bro on CentOS 5 successfully after a bit of work to get needed dependencies in place, but I can't seem to get around an issue where Bro complains about not being able to find any valid magic files when it starts. I get this error:
> internal error: can't load magic file <default>: could not find any valid magic files!
> I have my Bro executable installed to /opt/dcod/bin with all of the magic files from Bro in /opt/dcod/share/bro/magic (e.g., /opt/dcod/share/bro/magic/animation, /opt/dcod/share/bro/magic/archive, etc.). Permissions are fine. The "libmagic mime magic database search path" is set to /opt/dcod/share/bro/magic (Bro has actually been built with that path in it, but I've also set the BROMAGIC environment variable to the same for the hell of it to no avail).
> Any ideas? Is the search path for libmagic set correctly? I've been fighting with this problem for quite a while now.
> Scott Knick
> Bro mailing list
> bro at bro-ids.org
More information about the Bro