[Bro] Worker Crashed
Muhammad Hasif Sulaiman
hasifsulaiman94 at gmail.com
Thu Aug 2 23:44:13 PDT 2018
Hi, I'm new to bro, I set it up for about almost a month now, but recently
bro starts giving error, and when i checked bro status it shows that
worker-1-1, worker-1-2, and worker-1-3 are all crashed. I lacked knowledge
regarding this matter so i have included the logs when bro crashed and
hopefully it could help to explain what are the causes.
Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180803/e55b0153/attachment.html
-------------- next part --------------
03-04
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path reporter
#open 2018-08-03-03-28-55
#fields ts level message location
#types time enum string string
1533238134.691810 Reporter::INFO Failed to open GeoIP City database: /usr/local/share/GeoIP/GeoIPCity.dat (empty)
1533238134.691810 Reporter::ERROR Failed fall back to GeoIP Country database: /usr/local/share/GeoIP/GeoIP.dat (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30
1533238134.691810 Reporter::INFO Failed to open GeoIP Cityv6 database: /usr/local/share/GeoIP/GeoIPCityv6.dat (empty)
1533238134.691810 Reporter::INFO Failed to open GeoIPv6 Country database: /usr/local/share/GeoIP/GeoIPv6.dat (empty)
1533238134.691810 Reporter::ERROR Can't open GeoIPv6 City/Country database (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30
04-05
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path reporter
#open 2018-08-03-04-00-03
#fields ts level message location
#types time enum string string
1533240002.728989 Reporter::INFO Failed to open GeoIP City database: /usr/local/share/GeoIP/GeoIPCity.dat (empty)
1533240002.728989 Reporter::ERROR Failed fall back to GeoIP Country database: /usr/local/share/GeoIP/GeoIP.dat (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30
1533240002.728989 Reporter::INFO Failed to open GeoIP Cityv6 database: /usr/local/share/GeoIP/GeoIPCityv6.dat (empty)
1533240002.728989 Reporter::INFO Failed to open GeoIPv6 Country database: /usr/local/share/GeoIP/GeoIPv6.dat (empty)
1533240002.728989 Reporter::ERROR Can't open GeoIPv6 City/Country database (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30
#close 2018-08-03-05-00-00
08-09
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path reporter
#open 2018-08-03-08-43-29
#fields ts level message location
#types time enum string string
1533257009.326482 Reporter::INFO Failed to open GeoIP City database: /usr/local/share/GeoIP/GeoIPCity.dat (empty)
1533257009.326482 Reporter::ERROR Failed fall back to GeoIP Country database: /usr/local/share/GeoIP/GeoIP.dat (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30
1533257009.326482 Reporter::INFO Failed to open GeoIP Cityv6 database: /usr/local/share/GeoIP/GeoIPCityv6.dat (empty)
1533257009.326482 Reporter::INFO Failed to open GeoIPv6 Country database: /usr/local/share/GeoIP/GeoIPv6.dat (empty)
1533257009.326482 Reporter::ERROR Can't open GeoIPv6 City/Country database (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30
12-13
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path reporter
#open 2018-08-03-12-40-35
#fields ts level message location
#types time enum string string
0.000000 Reporter::WARNING SumStat key request for the yJm51Ija4n2 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the Rgjl3p5j8G6 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 0bBP4XPttp1 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the eV7UIeJ0lii SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 5sywAU43TZ3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the rpzJrsHAuoj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the fuGKtpF5yDh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the wkrlcxdspf4 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the nGiy2Px1Vj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the zX1md8gAVk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the nJ8eAOOtfee SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the URUoIOFOFxh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the LFcjViG44lb SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the nJx9urDeEhc SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the k5BLDhhBxvi SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the mk9hFatxsb SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the ZzqbLFgX9Jj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
13-14
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path reporter
#open 2018-08-03-13-00-35
#fields ts level message location
#types time enum string string
0.000000 Reporter::WARNING SumStat key request for the MRxrKLnNZl8 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 5MieYUYF0El SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the cD1NAIdOFI7 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the Y7jN1dWVLCc SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the XVm2IUbJ9b8 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the CbxVJLHz0b6 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the Ouk9VETPMu7 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 4eHw1xqUaIk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the huwzjWcmnz SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the GgopcTSUvWk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the N2GyKJTeIU8 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the BkXJmf8hoji SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the bYSydE8KbY7 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the vpnQcCyqICa SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the ZiYNuPKVemc SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the mswraHv9Tqk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the USf4di47F0i SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the TNUjUKCsJm9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the u2KmX2XYipk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the Z6W26Gm0SPa SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the Wo4pCvbP8Y9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the TVk1wA4DI4 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the YU0LLe1btHf SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the D1ZIm6iQ9C3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the vPsgst6ieKj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the A47jKfSNApl SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the c5qIGRRFUG5 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the nQfW85qFHI4 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the h0INflg0Cb9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 3hhgz39Vk82 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the GXKOoG2oKBe SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the hwuC2P9bN8g SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the PH3pCJG6gOh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the BtUVa3OC1y9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the MDRDGhqVO2a SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 3Dri8MvN5if SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the tyhuo0d2F3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the K9Y5N7FupKk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 2H1RD6Szna1 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the XUYJGaDHX5a SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the ZZWpYCM7gi3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the Rcdu031Ah05 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the LoMUR5Jfs05 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the 4Vq92NaNSoh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the HlSFXOt2Uze SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the siclIgJZp3f SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the DqKEYVf97fd SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the lTHlJ44cKFe SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the roQd5qhFg6 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
0.000000 Reporter::WARNING SumStat key request for the bcElnjIqr5i SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216
More information about the Bro
mailing list