[Bro] Segmentation fault while using own signature.

Seth Hall seth at icir.org
Tue Jan 17 19:58:59 PST 2017

> On Jan 17, 2017, at 4:07 PM, fatema bannatwala <fatema.bannatwala at gmail.com> wrote:

> Also, I m starting bro with following commands on manager:
> sudo -u bro /usr/local/bro/2.5/bin/broctl install
> sudo -u bro /usr/local/bro/2.5/bin/broctl restart
> However, when seeing the crash report on the sensor, it says No core file was found:
> (Any idea, why broctl isn't generating the core dump, or do I have to include any file in local.bro for the same?) 

Ah!  I suspect the problem is that you're starting Bro as the Bro user which probably doesn't have permission to increase it's maximum core file size to unlimited.

You can edit /etc/security/limits.conf and add the following line to it...

*  soft  core  unlimited

That should make it possible for Bro to have arbitrarily large core dumps.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list