[Bro] Log rotation and /dev/null with broctl

Matthias Vallentin vallentin at icir.org
Mon Oct 18 11:05:09 PDT 2010


I receive some unexplainable errors using broctl:

19 Oct 04:42:55 [output] /usr/local/share/broctl/scripts/archive-log: line 49: /home2/bro-logs/2010-10-16//dev/null.07:52:18-00:00:00.gz: No such file or directory
19 Oct 04:42:55 [output] 1287253800.000380 run-time error: rotate_file: can't move /dev/null to /dev/null.3123.1287253800.000380.tmp: File exists
19 Oct 04:42:55 [output] /usr/local/share/broctl/scripts/archive-log: line 49: /home2/bro-logs/2010-10-16//dev/null.07:52:18-00:00:00.gz: No such file or directory
19 Oct 04:42:55 [output] /usr/local/share/broctl/scripts/archive-log: line 49: /home2/bro-logs/2010-10-17//dev/null.00:00:00-00:00:00.gz: No such file or directory
19 Oct 04:42:55 [output] 1287340200.000090 run-time error: rotate_file: can't move /dev/null to /dev/null.3123.1287340200.000090.tmp: File exists
19 Oct 04:42:55 [output] /usr/local/share/broctl/scripts/archive-log: line 49: /home2/bro-logs/2010-10-16//dev/null.07:52:18-00:00:00.gz: No such file or directory

My broctl.cfg is pretty standard, with the only big difference being the change
of the log directory:

   LogDir = /home2/bro-logs

This is also weird:

    % file /dev/null
    /dev/null: ASCII text
    % more /dev/null
    title

It almost seems that broctl overwrote /dev/null. Does that make any
sense?

   Matthias



More information about the Bro mailing list