[Bro] "Resource temporarity unavailiable"

[Christian Kreibich]

Hi Mike,

(apologies for still not having fixed the bug in Bro that breaks one-way
event-relay functionality from a Bro node ... *sigh*.)

On Fri, 2005-07-15 at 17:20 -0500, Mike Muratet wrote:
> Greetings
> 
> I am (still) trying to get a working connection between some code I wrote 
> using broccoli calls and bro. (The code is part of a larger project that 
> uses bro for an interface because bro keeps track of state. and generates 
> events for connections.)  I thought I was making some headway with 
> understanding the event loop in bro and the reception in broccoli. I added a 
> print statement in the broccoli method __bro_sobject_data_get to try to 
> understand why I couldn't read the payload correctly and recompiled 
> broccoli. Now all communication has ceased and the bro debug.log shows 
> "Resource temporarily unavailable" which must be a system error because 
> there is no such string in bro or broccoli. This harkens back to a problem I 
> had when I first tried to use 'broping'.

I have seen that error too (and I've filed it in the "weird symptoms"
category), but I need more information to be able to help you.

- Are you using SSL? Try without first, if so.

- I presume you're on the latest Bro developer release?

Also, I'll need to have a look at:

- The Broccoli client code.

- The output of the Broccoli client with call tracing and debugging
output enabled.

- The Bro invocation command and any policies you're running if they're
non-standard.

- Bro's comm.log, remote.log, and debug.log produced on a run that
triggered the problem.

For what it's worth, so far the problem has never been actual protocol
breakage (as in Bro sending some serialized data and Broccoli being
unable to parse it, and vice versa).

I'll look at it asap if you send me more info, though I'll be offline
over the weekend.

Best of luck,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org