[Bro] Bro + PF_RING:ZC: workers crash

Jon Siwek jsiwek at corelight.com
Wed Jun 20 07:13:15 PDT 2018


On Tue, Jun 19, 2018 at 5:47 PM curtis kahn <ck2ha at virginia.edu> wrote:

> /mnt/localraid/bro/share/broctl/scripts/run-bro: line 107: 110538 Killed                  nohup ${pin_command} $pin_cpu "$mybro" "$@"

> Are there any ways to get more detailed logs to help understand why the worker crashed?

Pedantic, but that message looks like it was killed, not crashed.  For
crashes, unless you don't compile w/ debug symbols, a stack trace
would be generated.  For this case, maybe check system logs for more
info (e.g. a guess would be OOM killer).

- Jon


More information about the Bro mailing list