[Bro] ascii logger: unexpected modification to default_rotation_postprocessor_cmd and default_rotation_date_format during runtime

Frank Meier franky.meier.1 at gmx.de
Tue May 15 22:57:51 PDT 2018


Hi!

On Tue, 15 May 2018 14:59:10 -0400
"Seth Hall" <seth at corelight.com> wrote:

> 
> On 15 May 2018, at 6:28, Frank Meier wrote:
> 
> > I noticed a strange behavior: my bro 2.5.3 running on Linux for
> > about 15
> > days suddenly "forgot" my settings for
> > Log::default_rotation_postprocessor_cmd and
> 
> This has been a long standing bug that only ever seems to express
> itself on heavily loaded systems but generally seems to be somewhat
> rare.  We haven't been able to find the exact bug yet, but some of us
> have known about it for quite a while.  It would help if we could
> reproduce it reliably, but I suspect that in order to reproduce it we
> need to fully understand it first. :)
> 

Thanks, at least I am not alone with the problem! Perhaps it makes sense
to add some logging to the exotic code paths so we get some clues when
it happens again. I will have a look.

Franky.


More information about the Bro mailing list