[Bro] Nodes still crashing/Site specific files

[Richards, James L - DOA]

Ahhh,

  We are running pfring, which is located in /usr/local/pfring/lib which shows up doing an ldconfig -v

/usr/local/pfring/lib:
        libpfring.so -> libpfring.so
        libpcap.so.1 -> libpcap.so.1.1.1

But I am seeing that  libpcap.so.0.8 is being referenced in the error,  is this the issue which has been plaguing me?

James Richards
Office of Security
Wisconsin Department of Administration
608.224.3880


-----Original Message-----
From: Siwek, Jonathan Luke [mailto:jsiwek at illinois.edu] 
Sent: Thursday, June 13, 2013 3:00 PM
To: Richards, James L - DOA
Cc: bro at bro.org
Subject: Re: [Bro] Nodes still crashing/Site specific files


On Jun 13, 2013, at 2:04 PM, "Richards, James L - DOA" <James.Richards at wisconsin.gov>
 wrote:

> /usr/local/bro/bin/bro: error while loading shared libraries: libpcap.so.0.8: cannot open shared object file: No such file or directory

That usually means the linker can't resolve a path to that library.  Did you link against a libpcap that's installed in a non-standard path?  If `ldd /usr/local/bro/bin/bro` tells you it can't find libpcap, it's either really missing from your system or you need to teach the linker how to find it in a non-standard path.

> In looking at the below diag...  I am seeing an odd directory showing up in the BROPATH,  it looks like there are some artifacts of previous installations...
> 
> Where is the BROPATH set?

Check your etc/broctl.cfg to see if the paths are as you expect.  I think at least SpoolDir goes in to BROPATH and if you just copied the file from a previous install, then it's going to be wrong.

- Jon