[Bro] Bro processes not stopping on 'broctl restart'

Damian Gerow damian.gerow at shopify.com
Mon Apr 13 13:57:04 PDT 2015


I've been playing with some scripts in a local testing environment, and
I've noticed that sometimes, a given Bro process won't restart properly.
I've seen this before in the past, but I've only started paying attention
to it recently.  In all cases where I've paid attention it's been the
worker process.

Below is a process listing I've just taken, where a 'broctl restart' was
issued earlier in the day.  This is running Bro 2.3.2, in a very simple
configuration: one node is running manager, proxy, and worker; and there
are two additional worker nodes in the cluster.  Installation is done from
source.  In this case, none of the workers in the cluster were stopped
properly.

Is this a known issue?  Is there some kind of logging somewhere I can look
at to see what's going on?  As far as I can tell, the `broctl restart` is
succeeding without issue, but the old bro workers just aren't exiting.

```
# ps auxw | grep -i bro
bro       6590  0.0  0.0  19596  1700 ?        S    Apr02   0:00 bash /opt/
bro/share/broctl/scripts/run-bro -1 -i eth0 -U .status -p broctl -p broctl-live
-p local -p worker-0 local.bro broctl base/frameworks/cluster local-worker.
bro broctl/auto
bro       6605  5.2  3.1 154976 122300 ?       S    Apr02 829:09 /opt/bro
/bin/bro -i eth0 -U .status -p broctl -p broctl-live -p local -p worker-0
local.bro broctl base/frameworks/cluster local-worker.bro broctl/auto
bro       6610  4.2  1.3  90300 53320 ?        SN   Apr02 672:40 /opt/bro
/bin/bro -i eth0 -U .status -p broctl -p broctl-live -p local -p worker-0
local.bro broctl base/frameworks/cluster local-worker.bro broctl/auto
root     12066  0.0  0.0  10464   948 pts/0    S+   20:50   0:00 grep
--color=auto -i bro
bro      22790  0.0  0.0  17992  1592 ?        S    15:47   0:00 bash /opt/
bro/share/broctl/scripts/run-bro -1 -U .status -p broctl -p broctl-live -p
local -p manager local.bro broctl base/frameworks/cluster local-manager.bro
broctl/auto
bro      22799  2.3  1.6 767060 62336 ?        Sl   15:47   7:04 /opt/bro
/bin/bro -U .status -p broctl -p broctl-live -p local -p manager local.bro
broctl base/frameworks/cluster local-manager.bro broctl/auto
bro      22805  8.5  1.6  98588 61928 ?        SN   15:47  25:47 /opt/bro
/bin/bro -U .status -p broctl -p broctl-live -p local -p manager local.bro
broctl base/frameworks/cluster local-manager.bro broctl/auto
bro      22822  0.0  0.0  17992  1596 ?        S    15:47   0:00 bash /opt/
bro/share/broctl/scripts/run-bro -1 -U .status -p broctl -p broctl-live -p
local -p proxy-0 local.bro broctl base/frameworks/cluster local-proxy bro
ctl/auto
bro      22862  2.1  1.4  87424 54852 ?        R    15:47   6:40 /opt/bro
/bin/bro -U .status -p broctl -p broctl-live -p local -p proxy-0 local.bro
broctl base/frameworks/cluster local-proxy broctl/auto
bro      22863  8.5  1.6 100556 63864 ?        RN   15:47  26:02 /opt/bro
/bin/bro -U .status -p broctl -p broctl-live -p local -p proxy-0 local.bro
broctl base/frameworks/cluster local-proxy broctl/auto
bro      22890  0.0  0.0  17996  1600 ?        S    15:47   0:00 bash /opt/
bro/share/broctl/scripts/run-bro -1 -i eth0 -U .status -p broctl -p broctl-live
-p local -p worker-0 local.bro broctl base/frameworks/cluster local-worker.
bro broctl/auto
bro      22900  6.0  2.1 115420 82684 ?        S    15:47  18:28 /opt/bro
/bin/bro -i eth0 -U .status -p broctl -p broctl-live -p local -p worker-0
local.bro broctl base/frameworks/cluster local-worker.bro broctl/auto
bro      22905  4.2  1.3  90444 53700 ?        SN   15:47  12:44 /opt/bro
/bin/bro -i eth0 -U .status -p broctl -p broctl-live -p local -p worker-0
local.bro broctl base/frameworks/cluster local-worker.bro broctl/auto
#
```
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150413/356f6771/attachment.html 


More information about the Bro mailing list