[Bro] Bro sending sporadic email

[Robin Sommer]

On Wed, Aug 18, 2010 at 11:38 -0600, you wrote:

> Just last weekend, our Bro cluster started randomly skipping emailed
> reports. 

Sorry, no immediate idea.  Does this apply to both the alarm mail
and the traffic summaries? Are Bro's log files rotated and archived
correctly?

There's no logging for the reporting, so it's hard to say what's
going on. You could add some debugging output to the
postprocessor/{mail-log,summarize-connections} scripts to see if
they get executed.

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org