[Bro] all broctl instances are running yet broctl status shows stopped

[Glenn Forbes Fleming Larratt]

I've seen this as well, with the additional behavior that if I attempt a 
"broctl start", the processes all immediately crash.

I have had some success with doing "broctl stop", manually killing the 
remaining (unmanaged?) processes on each listener, *then* doing a "broctl 
start".

N.B. We are woefully behind, at release 2.3 .

 	-g

--
Glenn Forbes Fleming Larratt
Cornell University IT Security Office

On Tue, 20 Mar 2018, william de ping wrote:

> Hi all,
> 
> When running bro release 2.5 in cluster mode (manager,proxy and several workers) I have a strange issue :
> new logs are written to spool/manager and according to pgrep -c bro all instances are running, yet "broctl
> status" shows that all instances are stopped.
> 
> For some reason about an hour after using the "broctl deploy", this issue occurs again.
> 
> Any thoughts on what might cause this behavior ?
> I see no fix for this on newer versions.
> 
> Thank you
> B
> 
>