[Bro] Bro auto start at boot with Endace cards

Donaldson, John donaldson8 at llnl.gov
Tue Jul 28 13:32:56 PDT 2015


That’s possible, given the amount of time that dagsetup can take to set up the cards. We have Bro start with a normal init script (not in rc.local), but have never had this happen to us, on our 9.2X2 cards.


John Donaldson

From: bro-bounces at bro.org [mailto:bro-bounces at bro.org] On Behalf Of MILLER, BRAD L
Sent: Tuesday, July 28, 2015 2:20 PM
To: bro at bro.org
Subject: [Bro] Bro auto start at boot with Endace cards

My recent Bro config is coming along nicely, but I have run into one issue.

I followed the normal method to start Bro at system boot (added /usr/local/bro/bin/broctl start to /etc/rc.local), but this has resulted in bro crashing due to device dag0:0 being “busy”.  I find that two normal Bro processes are already started using this method, but broctl status indicates crashed.  Attempts to start Bro fail until I kill the existing Bro PIDs.  Once I do that, I can start Bro normally via broctl.

Is this an issue unique to Endace cards?  A race condition with Dag load?  Any ideas?

Brad Miller | Comerica Bank
Information Security Architecture
IT Security
Office: 248.371.4249  | Mobile: 920.378.8138

Please be aware that if you reply directly to this particular message, your reply may not be secure. Do not use email to send us communications that contain unencrypted confidential information such as passwords, account numbers or Social Security numbers. If you must provide this type of information, please visit comerica.com to submit a secure form using any of the ”Contact Us” forms. In addition, you should not send via email any inquiry or request that may be time sensitive. The information in this e-mail is confidential. It is intended for the individual or entity to whom it is addressed. If you have received this email in error, please destroy or delete the message and advise the sender of the error by return email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150728/91d255cd/attachment.html 

More information about the Bro mailing list