[Bro] Regarding Broctl cron

[Daniel Thayer]

On 4/14/17 10:46 AM, Azoff, Justin S wrote:
>
>> On Apr 14, 2017, at 10:34 AM, James Lay <jlay at slave-tothe-box.net> wrote:
>>
>> and from crontab:
>> 0-59/5 * * * * /opt/bro/bin/broctl cron
>>
>> Cron job just isn't restarting these....manually running broctl cron
>> works though.
>
> Is the cron job definitely running?  Is that in a users crontab or something in /etc/? If it's a system wide one in etc you'll need a user in there
>
> We use this:
>
> */5 * * * * root /bro/bin/broctl cron
>

Another thing to check is to run this command:
broctl cron '?'

The output should be:
cron enabled

If it says "disabled", then "broctl cron" won't do anything.