[Bro] Segmentation fault while using own signature.

[fatema bannatwala]

Hi Seth,

Thanks for the suggestions, still getting No core dump:

$ less /etc/security/limits.conf
#Editing the core dump limit to unlimited for Bro debugging
#*               soft    core            0
*               soft    core            unlimited

$ less .crash-diag.out
No core file found.

Bro 2.5
Linux 3.10.0-327.36.3.el7.x86_64

Bro plugins: (none found)

==== No reporter.log

<Truncated>

I will check to see what am I missing.

Thanks,
Fatema.

On Tue, Jan 17, 2017 at 10:58 PM, Seth Hall <seth at icir.org> wrote:

>
> > On Jan 17, 2017, at 4:07 PM, fatema bannatwala <
> fatema.bannatwala at gmail.com> wrote:
>
> > Also, I m starting bro with following commands on manager:
> > sudo -u bro /usr/local/bro/2.5/bin/broctl install
> > sudo -u bro /usr/local/bro/2.5/bin/broctl restart
> >
> > However, when seeing the crash report on the sensor, it says No core
> file was found:
> > (Any idea, why broctl isn't generating the core dump, or do I have to
> include any file in local.bro for the same?)
>
> Ah!  I suspect the problem is that you're starting Bro as the Bro user
> which probably doesn't have permission to increase it's maximum core file
> size to unlimited.
>
> You can edit /etc/security/limits.conf and add the following line to it...
>
> *  soft  core  unlimited
>
> That should make it possible for Bro to have arbitrarily large core dumps.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170118/6678c13d/attachment.html