[Bro-Dev] [JIRA] (BIT-1331) BroControl manager crashes when logs rotate

[Aaron Eppert (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1331?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=20008#comment-20008 ] 

Aaron Eppert edited comment on BIT-1331 at 3/17/15 6:38 PM:
------------------------------------------------------------

Encountering the same problem in a clustered configuration with only a single worker and proxy at the moment. Confirming the same error and the linked BIT-1253 ticket.

More data:

{noformat}
Bro 2.3-451-debug
Linux 2.6.32-504.8.1.el6.x86_64


==== reporter.log
{"ts":0.0,"level":"Reporter::ERROR","message":"no such index (Cluster::nodes[Intel::p$descr])","location":"/usr/local/bro/share/bro/base/frameworks/intel/./cluster.bro, line 37"}
{"ts":1426622062.691619,"level":"Reporter::ERROR","message":"extra base64 groups after \u0027=\u0027 padding are ignored","location":""}
{"ts":1426622062.691619,"level":"Reporter::ERROR","message":"incomplete base64 group, padding with 12 bits of 0","location":""}
{"ts":1426622072.075103,"level":"Reporter::ERROR","message":"extra base64 groups after \u0027=\u0027 padding are ignored","location":""}
{"ts":1426622072.075103,"level":"Reporter::ERROR","message":"incomplete base64 group, padding with 6 bits of 0","location":""}
{"ts":0.0,"level":"Reporter::ERROR","message":"no such index (Cluster::nodes[Intel::p$descr])","location":"/usr/local/bro/share/bro/base/frameworks/intel/./cluster.bro, line 37"}
{"ts":1426622135.535154,"level":"Reporter::ERROR","message":"extra base64 groups after \u0027=\u0027 padding are ignored","location":""}
{"ts":1426622140.709589,"level":"Reporter::ERROR","message":"extra base64 groups after \u0027=\u0027 padding are ignored","location":""}
{"ts":1426622140.709589,"level":"Reporter::ERROR","message":"incomplete base64 group, padding with 6 bits of 0","location":""}
{"ts":0.0,"level":"Reporter::ERROR","message":"no such index (Cluster::nodes[Intel::p$descr])","location":"/usr/local/bro/share/bro/base/frameworks/intel/./cluster.bro, line 37"}

==== stderr.log
warning in /usr/local/bro/spool/installed-scripts-do-not-touch/site/ps-detections/credit-card-exposure/./main.bro, line 83: deprecated (split_all)
warning in /usr/local/bro/spool/installed-scripts-do-not-touch/site/ps-detections/credit-card-exposure/./main.bro, line 93: deprecated (join_string_array)
fatal error in <no location>: Val::CONVERTER (string/port) (80/tcp)

==== stdout.log
PacketFilter::LOG
X509::LOG
Software::LOG
SSH::LOG
DHCP::LOG
DNS::LOG
HTTP::LOG
SOCKS::LOG
DNP3::LOG
Known::HOSTS_LOG

==== .cmdline
-U .status -p broctl -p broctl-live -p local -p manager local.bro broctl base/frameworks/cluster local-manager.bro broctl/auto -B threading

==== .env_vars
PATH=/usr/local/bro/bin:/usr/local/bro/share/broctl/scripts:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/tokumx/bin:/root/bin
BROPATH=/usr/local/bro/spool/installed-scripts-do-not-touch/site::/usr/local/bro/spool/installed-scripts-do-not-touch/auto:/usr/local/bro/share/bro:/usr/local/bro/share/bro/policy:/usr/local/bro/share/bro/site
CLUSTER_NODE=manager

==== .status
TERMINATED [atexit]

==== No prof.log

{noformat}



was (Author: aeppert):
Encountering the same problem in a clustered configuration with only a single worker and proxy at the moment. Confirming the same error and the linked BIT-1253 ticket.

Also getting this:

fatal error in <no location>: val::CONVERTER (string/port) (80/tcp)

> BroControl manager crashes when logs rotate
> -------------------------------------------
>
>                 Key: BIT-1331
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1331
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: git/master, 2.4
>         Environment: Ubuntu 12.04.5 LTS, PF_RING lb_method
>            Reporter: Josh Liburdi
>            Priority: High
>             Fix For: 2.4
>
>
> The BroControl manager crashes when the logs rotate. Workers run fine through this process. 
> stderr.log output:
> internal error: finish missing
> /usr/local/bro/share/broctl/scripts/run-bro: line 100: 157357 Aborted                 (core dumped) nohup "$mybro" "$@"
> send-mail: SENDMAIL-NOTFOUND not found



--
This message was sent by Atlassian JIRA
(v6.4-OD-15-055#64014)