[Bro] Bro Digest, Vol 92, Issue 24

Andy Schworer schworer at gmail.com
Sat Dec 21 13:58:37 PST 2013


I found a couple fresh segfaults in syslog.  What is "error 4 in bro..."?

Dec 20 21:37:41 node4 kernel: [13454949.834289] bro[19790]: segfault at 28
ip 00000000005effbc sp 00007fff438b7cf0 error 4 in bro[400000+4ab000]
Dec 21 19:09:40 node4 kernel: [13532430.859123] bro[17657]: segfault at
74656e2e71 ip 000000000051c0b9 sp 00007fffe8e2a3c8 error 4 in
bro[400000+4ab000]


On Sat, Dec 21, 2013 at 12:00 PM, <bro-request at bro.org> wrote:

> Send Bro mailing list submissions to
>         bro at bro.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> or, via email, send a message with subject or body 'help' to
>         bro-request at bro.org
>
> You can reach the person managing the list at
>         bro-owner at bro.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Bro digest..."
>
>
> Today's Topics:
>
>    1. Bro Silent Crash (Andy Schworer)
>    2. Re: Bro Silent Crash (James Lay)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 20 Dec 2013 14:00:37 -0800
> From: Andy Schworer <schworer at gmail.com>
> Subject: [Bro] Bro Silent Crash
> To: bro at bro.org
> Message-ID:
>         <
> CANQy5G0Ai6WGSGLC-+5QNSainuLb0vHmBDRG60AXt7bwhYwMtA at mail.gmail.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Possibly a newb question, but "broctl status" is reporting bro is running,
> but broctl restart reportings taht bro was not running because it crashed.
>  Why the discrepancy? Also, log/current/stderr.log & srdout.log do not
> contain any information regarding the crash.  Is this crash info stored
> else where?
>
> Thanks
>
> root at node4:/usr/local/bro# bin/broctl status
> > Name       Type       Host       Status        Pid    Peers  Started
> >
> > bro        standalone localhost  running       22880  0      06 Dec
> > 23:49:28
> > root at node4:/usr/local/bro# bin/broctl restart
> > stopping ...
> > warning: cannot send mail
> > bro not running (was crashed)
> > starting ...
> > starting bro ...
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131220/54cc71de/attachment-0001.html
>
> ------------------------------
>
> Message: 2
> Date: Fri, 20 Dec 2013 15:12:21 -0700
> From: James Lay <jlay at slave-tothe-box.net>
> Subject: Re: [Bro] Bro Silent Crash
> To: <bro at bro.org>
> Message-ID: <66b329801613a3f5b475326fbe3f7645 at localhost>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 2013-12-20 15:00, Andy Schworer wrote:
> > Possibly a newb question, but "broctl status" is reporting bro is
> > running, but broctl restart reportings taht bro was not running
> > because it crashed. ?Why the discrepancy? Also,
> > log/current/stderr.log & srdout.log do not contain any information
> > regarding the crash. ?Is this crash info stored else where?
> >
> > Thanks
> >
> >> root at node4:/usr/local/bro# bin/broctl status
> >> Name ? ? ? Type ? ? ? Host ? ? ? Status ? ? ? ?Pid ?
> >> ?Peers ?Started ? ? ? ? ? ? ?
> >> bro ? ? ? ?standalone localhost ?running ? ? ? 22880 ?0 ?
> >> ? ?06 Dec 23:49:28
> >> root at node4:/usr/local/bro# bin/broctl restart
> >> stopping ...
> >> warning: cannot send mail
> >> bro not running (was crashed)
> >> starting ...
> >> starting bro ...
>
> How's your syslog lookin?
>
> Dec 19 14:09:26 gateway kernel: bro[16591]: segfault at 0 ip (null) sp
> 00007fffa051d1a8 error 14 in bro[400000+4e3000]
>
> James
>
>
> ------------------------------
>
> _______________________________________________
> Bro mailing list
> Bro at bro.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>
> End of Bro Digest, Vol 92, Issue 24
> ***********************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131221/ebdc32f7/attachment.html 


More information about the Bro mailing list