[Bro-Dev] [JIRA] (BIT-1111) will not start

[Jon Siwek (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1111?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15200#comment-15200 ] 

Jon Siwek commented on BIT-1111:
--------------------------------

Three options to fix your install:

1) Just install libmagic from MacPorts.
2) Compile/install Bro from source.
3) Install libmagic from source or a different package manager, but make sure when running Bro that the MAGIC environment variable points to the magic database file that comes with it.

I'd suggest going w/ option 2.

Explanation: OS X doesn't ship with libmagic, so the binary package for Bro on OS X was compiled against a MacPorts' libmagic statically.  Unfortunately, that's not enough to make the binary package completely independent as Bro still expects the "default" database shipping w/ libmagic to be present, which it may not always be on the system where it's installed.  The way to fix this in Bro itself would be to consolidate libmagic usage to rely on database(s) that ship w/ Bro and possibly even redistribute a version of libmagic w/ Bro so it can be compiled against a consistent version guaranteed to work w/ the database(s) (I'm in favor of both).

> will not start
> --------------
>
>                 Key: BIT-1111
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1111
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: 2.2
>         Environment: Mac OSX 10.9
>            Reporter: Chas DiFatta
>            Priority: High
>              Labels: broctl
>
> there is a problem when starting as i get the following error
> internal error: can't load magic file <default>: no magic files loaded
> /opt/bro/share/broctl/scripts/run-bro: line 82:  1175 Abort trap: 6           (core dumped) nohup $mybro "$@"
> have a new mac running 10.9.  downloaded 2.2 for OSX, it installed fine.  followed the recommended changes to the config files. ran the following command as root.
> sh-3.2# ./broctl
> Welcome to BroControl 1.2
> Type "help" for help.
> [BroControl] > install
> removing old policies in /opt/bro/spool/installed-scripts-do-not-touch/site ... done.
> removing old policies in /opt/bro/spool/installed-scripts-do-not-touch/auto ... done.
> creating policy directories ... done.
> installing site policies ... done.
> generating standalone-layout.bro ... done.
> generating local-networks.bro ... done.
> generating broctl-config.bro ... done.
> updating nodes ... done.
> [BroControl] > start
> starting bro ...
> .
> bro terminated immediately after starting; check output with "diag"
> [BroControl] > diag
> [bro]
> Bro 2.2
> Darwin 13.0.0
> No gdb installed.
> ==== No reporter.log
> ==== stderr.log
> internal error: can't load magic file <default>: no magic files loaded
> /opt/bro/share/broctl/scripts/run-bro: line 82:  1175 Abort trap: 6           (core dumped) nohup $mybro "$@"
> ==== stdout.log
> unlimited
> unlimited
> unlimited
> ==== .cmdline
> -i eh0 -U .status -p broctl -p broctl-live -p standalone -p local -p bro local.bro broctl broctl/standalone broctl/auto
> ==== .env_vars
> PATH=/opt/bro/bin:/opt/bro/share/broctl/scripts:/opt/local/bin:/opt/local/sbin:/opt/local/bin:/opt/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
> BROPATH=/opt/bro/spool/installed-scripts-do-not-touch/site::/opt/bro/spool/installed-scripts-do-not-touch/auto:/opt/bro/share/bro:/opt/bro/share/bro/policy:/opt/bro/share/bro/site
> CLUSTER_NODE=
> ==== .status
> TERMINATED [internal_error]
> ==== No prof.log
> ==== No packet_filter.log
> ==== No loaded_scripts.log



--
This message was sent by Atlassian JIRA
(v6.2-OD-07-027#6211)