[Bro] Bro crashing on start
Drake Aronhalt
drakearonhalt at gmail.com
Thu Oct 6 20:01:50 PDT 2016
All,
This morning I updated bro and pfring on my dev sensor to their
respective git master branches and started receiving this error when I try
to start bro:
# broctl start
starting logger ...
starting manager ...
starting proxy-1 ...
starting worker-1-1 ...
starting worker-1-2 ...
starting worker-1-3 ...
starting worker-1-4 ...
starting worker-1-5 ...
worker-1-5 terminated immediately after starting; check output with "diag"
worker-1-4 terminated immediately after starting; check output with "diag"
worker-1-1 terminated immediately after starting; check output with "diag"
worker-1-3 terminated immediately after starting; check output with "diag"
worker-1-2 terminated immediately after starting; check output with "diag"
running 'broctl diag' gives me this
fatal error: problem with interface eno33557248 (pcap_error: BPF
program is not valid)
pf_ring is loading properly as far as I can tell. My node.cfg is below:
[logger]
type=logger
host=localhost
[manager]
type=manager
host=localhost
[proxy-1]
type=proxy
host=localhost
[worker-1]
type=worker
host=localhost
interface=eno33557248
lb_method=pf_ring
lb_procs=5
pin_cpus=2,3,4,5,6
Any ideas on what causes this? Should I just roll back to my last config
that worked, or did I miss a change in bro 2.5 config?
Drake
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161006/e3c63625/attachment.html
More information about the Bro
mailing list