[Bro-Dev] broctl process tracking problems

[Seth Hall]

Has anyone else ever had trouble with broctl getting confused about the status of a process?  I just ran into it a little bit ago where broctl thought that all of my workers were dead when I tried to do a restart command.  They failed when they were trying to start again because with the myricom sniffer drivers you can only sniff the interface once.

We need to do some debugging on this, but it happens sporadically enough that it might be tough.  I sort of wonder if there are issues with broctl.dat being written, I've run into problems in that file before where things wouldn't be written right.  Would it make sense to maybe even move away from broctl.dat (which tracks cluster state) and toward something like an SQLite database?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/