[Bro] Bro crashes regularly

[Seth Hall]

On Sep 7, 2011, at 9:21 AM, Will Urbanski wrote:

> Hello! I am experiencing an issue where bro regularly crashes. A crash
> log is appended to this email

We have a ticket filed for that bug and I expect a fix in the next day or two.

> If there is no bug fix at this time, does anyone have a script that will
> check if bro has crashed and will restart in broctl? If the workers have
> crashed and I run 'check' in broctl it says that all workers and proxys
> are OK, but then if i do 'restart' it says that they have crashed. This
> might be another bug.

Oh sorry, BroControl should be managing this for you already.  You just need to set a cron job that runs BroControl's "cron" command every 5 minutes or so.  Here's what I usually use...

*/5 * * * * /bro/bin/broctl cron

You just need to adjust the path based on where you installed broctl obviously. :)  That will check to make sure everything is running and take care of a few other minor details as well.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/