[Bro] failed to start BRO

[jean-philippe luiggi]

* jags0nhak3r at engineer.com <jags0nhak3r at engineer.com> [2009-10-29 03:34:51 -0400]:

> 
> Hi everyone
> 
> I am new to Bro IDS 1.4, I have tried to install it on CentOs platform. well, at the beginning It was difficul, however I manage to install it with the same instructions
> 
> ./configure
> 
> make 
> make install
> 
> make install-brolite
> 
> bro-lite did a very well job. It created all the directories in bro home directory /usr/local/bro
> 
> [bro at localhost bro]$ ls
> archive  bin  etc  include  lib  logs  reports  scripts  share  site  var
> 
> the problem I am facing is that when I try to start bro using bro.rc file with this  {BROHOME}/etc/bro.rc start it fails and gives me this erro
> 
> [bro at localhost ~]$ /usr/local/bro/etc/bro.rc start
> bro.rc: Starting ..........bro.rc: Failed to start Bro
> line 1: error: can't open localhost.localdomain.bro
> ... FAILED
> 
> Note: i have tried to change my host name to localhost.localdomain.bro
> 
> Any ideas please.. help

  Hello,

  Bro is searching for a file called "localhost.localdomain.bro" in the
  various path defined in your BROPATH environment variable.
  
  So two questions :
  
  Do your file exists somewhere ?
  Is it in a directory specied in "BROPATH" ?
  
  Mine is defined as follow into my .bashrc :
  
  export BROPATH=/opt/share/bro/policy
  
  Cheers,
  
  Jean-Philippe.