[Bro-Dev] [JIRA] (BIT-1510) Crash reports when no crash happened

Daniel Thayer (JIRA) jira at bro-tracker.atlassian.net
Thu Jan 21 14:32:00 PST 2016

    [ https://bro-tracker.atlassian.net/browse/BIT-1510?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=23917#comment-23917 ] 

Daniel Thayer commented on BIT-1510:

Currently, when "broctl stop" sends SIGTERM to Bro, if a Bro process
terminates but does not write "TERMINATED" to its ".status" file, then
broctl marks the process as "crashed" (and the user sees a message
such as "worker-1 crashed during shutdown").  If a user then runs
"broctl status", they will see that node is "crashed".  Then, when "broctl start"
runs, it sees the crashed status and sends a crash report.

Seth, is this the scenario that you want changed? (i.e., in the above
scenario, a "broctl stop" would still output "worker-1 crashed during shutdown",
but then "broctl status" would show the node as "stopped" instead of "crashed")

> Crash reports when no crash happened
> ------------------------------------
>                 Key: BIT-1510
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1510
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: BroControl
>    Affects Versions: git/master
>            Reporter: Seth Hall
>             Fix For: 2.5
> We need to make broctl stop sending crash reports when Bro was shutdown by a signal.  It's confusing for users because they will get these emails sporadically when restarting Bro.
> The crash report typically has the following text and no backtrace:
> ==== stderr.log
> received termination signal

This message was sent by Atlassian JIRA

More information about the bro-dev mailing list