[Bro] Bro Crashing on Reboot (Cluster-Layout)

Damon Rouse damonrouse at gmail.com
Fri Aug 7 11:41:06 PDT 2015


I posted this to the SO list, but haven't received any responses, so wanted
to post here too.

Anytime I need to reboot my SO box, Bro tries to start normally but then
terminates and I get crash alerts.  They seem to point to something with
the cluster layout, but I'm not sure how to fix it or why it started.

I usually need to a couple rounds of broctl deploy, kill bro, then do the
same and it eventually starts fine.

This Bro 2.4 under Security Onion

See the crash log below--any ideas or help is much appreciated

Crash Report from Manager:
Bro 2.4
Linux 3.2.0-88-generic


==== No reporter.log

==== stderr.log
fatal error in /opt/bro/share/bro/base/frameworks/cluster/__load__.bro,
line 16: can't find cluster-layout

==== stdout.log
max memory size         (kbytes, -m) unlimited
data seg size           (kbytes, -d) unlimited
virtual memory          (kbytes, -v) unlimited
core file size          (blocks, -c) unlimited

==== .cmdline
-U .status -p broctl -p broctl-live -p local -p manager local.bro broctl
base/frameworks/cluster local-manager.bro broctl/auto

==== .env_vars
PATH=/opt/bro/bin:/opt/bro/share/broctl/scripts:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
BROPATH=/nsm/bro/spool/installed-scripts-do-not-touch/site::/nsm/bro/spool/installed-scripts-do-not-touch/auto:/opt/bro/share/bro:/opt/bro/share/bro/policy:/opt/bro/share/bro/site
CLUSTER_NODE=manager

==== .status
TERMINATED [atexit]

==== No prof.log

==== No packet_filter.log

==== No loaded_scripts.log
--
[Automatically generated.]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150807/47cf1525/attachment.html 


More information about the Bro mailing list