[Zeek] Anyone using DoveHawk under Zeek 3.0.6

Carlos Lopez clopmz at outlook.com
Thu May 7 01:44:50 PDT 2020


Hi all,

Today I have updated my Zeek cluster to release 3.0.6. I have installed dovehawk package also, but it is not downloading IOC from my MISP instance. Errors are:

{"ts":"2020-05-07T08:40:39.980846Z","level":"Reporter::ERROR","message":"curl --header \"Authorization: \"AFz6lL1d2PMLPQ9O1V7OVoCOhawbXEZ9S01wu5GS\"\" -s -g -o \"\"/tmp/zeek-activehttp-E4Z8Vauqaq3_body\"\
" -D \"\"/tmp/zeek-activehttp-E4Z8Vauqaq3_headers\"\" -X \"\"GET\"\" -m 60 \"\"https://stonehaven.lab.uxdom.org/attributes/bro/download/all\"\" && touch \"/tmp/zeek-activehttp-E4Z8Vauqaq3_body\" |/Input::
READER_RAW: Child process exited with non-zero return code 60","location":""}
{"ts":"2020-05-07T08:40:39.980846Z","level":"Reporter::ERROR","message":"curl --header \"Authorization: \"AFz6lL1d2PMLPQ9O1V7OVoCOhawbXEZ9S01wu5GS\"\" -s -g -o \"\"/tmp/zeek-activehttp-FRYEeOTxgol_body\"\
" -D \"\"/tmp/zeek-activehttp-FRYEeOTxgol_headers\"\" -X \"\"GET\"\" -m 60 \"\"https://stonehaven.lab.uxdom.org/attributes/text/download/zeek\"\" && touch \"/tmp/zeek-activehttp-FRYEeOTxgol_body\" |/Input
::READER_RAW: Child process exited with non-zero return code 60","location":""}
{"ts":"2020-05-07T08:40:39.982698Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-E4Z8Vauqaq3_body/Input::READER_RAW: Init: cannot open /tmp/zeek-activehttp-E4Z8Vauqaq3_body","location":""}
{"ts":"2020-05-07T08:40:39.982698Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-E4Z8Vauqaq3_body/Input::READER_RAW: Init failed","location":""}
{"ts":"2020-05-07T08:40:39.982698Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-E4Z8Vauqaq3_body/Input::READER_RAW: terminating thread","location":""}
{"ts":"2020-05-07T08:40:39.982698Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-FRYEeOTxgol_body/Input::READER_RAW: Init: cannot open /tmp/zeek-activehttp-FRYEeOTxgol_body","location":""}
{"ts":"2020-05-07T08:40:39.982698Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-FRYEeOTxgol_body/Input::READER_RAW: Init failed","location":""}
{"ts":"2020-05-07T08:40:39.982698Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-FRYEeOTxgol_body/Input::READER_RAW: terminating thread","location":""}

Any light on this?

Regards,
C. L. Martinez
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20200507/d45b3fa1/attachment.html 


More information about the Zeek mailing list