[Bro-Dev] broctl process tracking problems

[Seth Hall]

On Feb 17, 2012, at 1:23 PM, Will wrote:

> I had the same issue a time or two.  Running 'broctl ps.bro' right after 'broctl status' has become part of my new ritual before stopping/starting or just restarting any of my clusters.

That's actually perfect!  Sometime could you make a copy of your spool/broctl.dat before you restart?

I'd like two copies of that file.  One before a restart and one after the restart (assuming the restart fails).  It could point out if there is corruption entering the broctl.dat file at some point.  This problem drives me crazy and I'd love to fix it.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/