[Bro] all broctl instances are running yet broctl status shows stopped

Daniel Thayer dnthayer at illinois.edu
Tue Mar 20 11:47:10 PDT 2018


On 3/20/18 11:52 AM, william de ping wrote:
> Hi
> 
> Thanks for your replies
> 
> broctl diag returns "HINT : Run broctl deploy to get started.
> All the rest of the output is not populated
> 
> broctl deploy solves this issue, but I do not want to restart my cluster 
> every hour
> 
> B
> 

OK, that is what I expected.  You have two different copies of Bro
installed on your system (doesn't matter if they are the same
version or not), and I recommend removing one of them to
avoid confusion.

This problem could happen, for example, if you have two copies
of Bro installed and you run "sudo broctl deploy", but then later
you run "broctl status" and this actually runs the other copy (on
most systems, "sudo" uses a different PATH than normal users).
Each installation of Bro includes its own scripts, config files,
executables, state file, etc.


More information about the Bro mailing list