[Bro-Dev] [JIRA] (BIT-1390) Orphaned field addl
Robin Sommer
robin at icir.org
Tue Apr 28 21:56:37 PDT 2015
The "addl" and "hot" fields have been removed from the connection
record recently. From a quick look I don't see them being used in the
standard scripts anymore. Is it possible that you have a custom script
creating that record?
On Tue, Apr 28, 2015 at 23:44 -0500, you wrote:
> Josh Liburdi created BIT-1390:
> ---------------------------------
>
> Summary: Orphaned field addl
> Key: BIT-1390
> URL: https://bro-tracker.atlassian.net/browse/BIT-1390
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: git/master
> Environment: I'm running master (current as of 04/21/2015) in a cluster environment and am receiving thousands of these reporter.log errors each minute:
>
> orphan field "addl" in initialization ([uid=ColGFv4htljLxPq9yg, id=[orig_h=<addr>, orig_p=<port>/udp, resp_h=<addr>, resp_p=<port>/udp], history=Dd, duration=0.03419, start_time=0, addl=, hot=0])
>
> I've masked the actual connection data (addrs and ports), but the error is the same across multiple Bro deployment
More information about the bro-dev
mailing list