[Bro-Dev] [JIRA] (BIT-1461) Bro Mgr Scripts Fail After Threat Intel Feed Add

Johanna Amann (JIRA) jira at bro-tracker.atlassian.net
Thu Oct 22 07:38:00 PDT 2015

    [ https://bro-tracker.atlassian.net/browse/BIT-1461?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22639#comment-22639 ] 

Johanna Amann commented on BIT-1461:

This error message shows that the value "unknown" was encountered when a enum type was expected. Hence you probably have an "unknown" in your indicator column somewhere for that data source.

In Bro 2.3, encountering an undefined enum was a fatal error (i.e. Bro shut down immediately), in 2.4 it only is reported as an error from the input framework when reading the file.

Just taking care that there are no such values in the input file should fix this problem.

> Bro Mgr Scripts Fail After Threat Intel Feed Add
> ------------------------------------------------
>                 Key: BIT-1461
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1461
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: 2.5
>            Reporter: Tim Jackson
>            Priority: Low
> Getting the following on check after inclusion of 3rd party threat intel feeds. Unsure of how to continue
> manager scripts failed.
>    internal error: Value not found in enum mappimg. Module: Intel, var: undefined, var size: 9
>    /opt/bro/share/broctl/scripts/check-config: line 28: 30661 Aborted                 (core dumped) ${bro} "$@"
> proxy scripts are ok.
> calidcbrosrv001-eth1-1 scripts are ok.
> calidcbrosrv001-eth1-2 scripts are ok.
> Thanks
> Tim

This message was sent by Atlassian JIRA

More information about the bro-dev mailing list