[Bro] can not start bro

[Russell Fulton]

On 27/06/2014, at 6:46 pm, Daniel Thayer <dnthayer at illinois.edu> wrote:

> You probably forgot to run "broctl install”.

I’m an idiot!  but it would be nice if broctl start did some sanity checking!

I manage my sensors with puppet — I need to add and exec to run broctl install if the bro-spool/installed-scripts… does not exist after the config files are put in place.

> 
> -Daniel
> 
> 
> On 06/26/2014 11:42 PM, Russell Fulton wrote:
>> I had a series of problems on one sensor (disk full and consequent issues) and now when I try
>> 
>> broctl start
>> 
>> it tries to start the manager and just hangs.
>> 
>> rful011 at secmontst01:/opt/bro/etc$ sudo broctl start
>> warning: removing stale lock
>> starting manager …
>> 
>> after killing it I find:
>> 
>> rful011 at secmontst01:/opt/bro/etc$ cat ~sensors/data/dmzo/bro-spool/manager/stderr.log
>> nohup: failed to run command `/run-bro': No such file or directory
>> 
>> timestamp is current.
>> 
>> Bro is installed using securityoinion-bro — I have tried removing and installing it again but it does not make any difference.
>> 
>> Any ideas on what to look for.
>> 
>> Russell
>>