[Bro-Dev] [JIRA] (BIT-1390) Orphaned field addl

Robin Sommer robin at icir.org
Tue Apr 28 21:56:37 PDT 2015


The "addl" and "hot" fields have been removed from the connection
record recently. From a quick look I don't see them being used in the
standard scripts anymore. Is it possible that you have a custom script
creating that record?

On Tue, Apr 28, 2015 at 23:44 -0500, you wrote:

> Josh Liburdi created BIT-1390:
> ---------------------------------
> 
>              Summary: Orphaned field addl
>                  Key: BIT-1390
>                  URL: https://bro-tracker.atlassian.net/browse/BIT-1390
>              Project: Bro Issue Tracker
>           Issue Type: Problem
>           Components: Bro
>     Affects Versions: git/master
>          Environment: I'm running master (current as of 04/21/2015) in a cluster environment and am receiving thousands of these reporter.log errors each minute: 
> 
> orphan field "addl" in initialization ([uid=ColGFv4htljLxPq9yg, id=[orig_h=<addr>, orig_p=<port>/udp, resp_h=<addr>, resp_p=<port>/udp], history=Dd, duration=0.03419, start_time=0, addl=, hot=0]) 
> 
> I've masked the actual connection data (addrs and ports), but the error is the same across multiple Bro deployment


More information about the bro-dev mailing list