[Bro] Can't load magic file <default> on CentOS 5

Knick, Scott E CTR USARMY RCERT-EUR (US) scott.e.knick.ctr at mail.mil
Wed May 7 06:57:29 PDT 2014


I did discover a solution based on the following bug report, though I'm still fighting through some other issues.

https://bro-tracker.atlassian.net/browse/BIT-1111

Basically, you have to also (or rather?) set the MAGIC environment variable, not just the BROMAGIC environment variable.

My conundrum seems to be happening because I need to be able to run on CentOS 5 (or RHEL 5), but that distro is stuck with libmagic version 4, and I can't figure out how to upgrade the system to version 5 without ruining a bunch of things.

-----Original Message-----
From: Mike Kolkebeck [mailto:mkolkebeck at gmail.com] 
Sent: Wednesday, May 07, 2014 3:54 PM
To: Knick, Scott E CTR USARMY RCERT-EUR (US)
Cc: bro at bro.org
Subject: Re: [Bro] Can't load magic file <default> on CentOS 5

I've had the same problem when upgrading to libmagic 5.18 (file-5.18), using Bro 2.2.

It worked fine with file-5.16.

Are there any quick fixes out there without having to downgrade?


> On May 7, 2014, at 8:20 AM, "Knick, Scott E CTR USARMY RCERT-EUR (US)" <scott.e.knick.ctr at mail.mil> wrote:
> 
> I've managed to build Bro on CentOS 5 successfully after a bit of work to get needed dependencies in place, but I can't seem to get around an issue where Bro complains about not being able to find any valid magic files when it starts. I get this error:
> 
> internal error: can't load magic file <default>: could not find any valid magic files!
> 
> I have my Bro executable installed to /opt/dcod/bin with all of the magic files from Bro in /opt/dcod/share/bro/magic (e.g., /opt/dcod/share/bro/magic/animation, /opt/dcod/share/bro/magic/archive, etc.). Permissions are fine. The "libmagic mime magic database search path" is set to /opt/dcod/share/bro/magic (Bro has actually been built with that path in it, but I've also set the BROMAGIC environment variable to the same for the hell of it to no avail).
> 
> Any ideas? Is the search path for libmagic set correctly? I've been fighting with this problem for quite a while now.
> 
> --
> Scott Knick
> 
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro




More information about the Bro mailing list