[Bro] [BRO-ISSUE]: bro crash when so many Repoter::Error calls

Azoff, Justin S jazoff at illinois.edu
Thu Jan 25 08:46:17 PST 2018


> On Jan 25, 2018, at 11:18 AM, Myth Ren <email4myth at gmail.com> wrote:
> 
>  then KafkaWriter call Reporter::Error to report the runtime error. 

This would be a problem if bro is configured to send the reporter.log to Kafka.

Reporter::Error generates a reporter_error event which then calls

    Log::write(Reporter::LOG, [$ts=t, $level=ERROR, $message=msg, $location=location]);

So you're probably also ending up in the situation where bro is trying to log to Kafka the fact that Kafka is broken.

If you tell bro to not send the reporter.log to Kafka, does your problem go away?

— 
Justin Azoff




More information about the Bro mailing list