[Bro] Getting a Broctl Stack Trace
turbidtarantula at gmail.com
Tue Nov 20 14:43:28 PST 2018
Thank you for the suggestion. Adding that setting to broctl.cfg didn't make
a difference, but I did notice that when I run broctl deploy I get "(bro
still initializing)" at the end. Since I don't normally see that it makes
me think something isn't coming up correctly, rather than an actual
Are there other options I should try setting in broctl.cfg, or anything
else I can do to diagnose what's not working as broctl expects?
On Fri, Nov 16, 2018 at 9:59 PM Azoff, Justin S <jazoff at illinois.edu> wrote:
> I'm not 100% sure about the root cause, but I know one thing that may
> help.. there's a code path for 'broctl start' that will say something has
> "crashed" when it is "not running".. but "not running" doesn't have to be a
> segfault... just that it didn't fully initialize in the way that broctl was
> expecting it to.
> Hosom was also looking into this today and said he was seeing:
> warning in /usr/local/bro/share/bro/base/init-bare.bro, line 1: problem
> initializing NB-DNS: no valid nameservers in resolver config
> It may be a red herring, but that's easy to rule out:
> to broctl.cfg
> and deploy and see if things start properly with real DNS disabled.
> *From:* bro-bounces at bro.org <bro-bounces at bro.org> on behalf of Mike M <
> turbidtarantula at gmail.com>
> *Sent:* Tuesday, November 13, 2018 11:22:10 AM
> *To:* seth at corelight.com
> *Cc:* bro at bro.org
> *Subject:* Re: [Bro] Getting a Broctl Stack Trace
> I gave this a shot but I'm still not seeing a core file. I tried both the
> setting you recommended and setting an absolute path to /tmp. When I force
> a core dump on another process the core file shows up as expected, but
> broctl isn't producing one.
> I'm open to suggestions on this one... not sure how to determine the root
> On Mon, Nov 5, 2018 at 5:01 PM Seth Hall <seth at corelight.com> wrote:
> Make sure you are setting the core pattern on your system so that the
> core dump will be written into the CWD.
> sudo sysctl -w kernel.core_pattern="core.%e-%t-%p"
> On 2 Nov 2018, at 12:51, Mike M wrote:
> > I'm having an issue with broctl crashing when I try to run it on
> > Alpine
> > Linux. I mentioned it previously  but I'm circling back around to
> > try to
> > get it resolved. I've built it with the appropriate patches  but
> > broctl
> > is still reporting "crashed" state when I checks the status after
> > starting
> > it. The bro binary itself runs fine.
> > What do I need to do to collect a stack trace from broctl to determine
> > the
> > root cause?
> > Bro is built in debug mode and I set "ulimit -c unlimited" per the
> > instructions on reporting problems. I see a
> > directory but there's no core dump anywhere obvious. The
> > .crash-diag.out
> > file says "No core file found" and doesn't provide any useful
> > information
> > about the cause of the crash.
> > Thanks,
> > Mike
> > 
> > 
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> Seth Hall * Corelight, Inc * www.corelight.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro