# All cluster instances are stopped yet their process is alive

**URL:** <https://community.zeek.org/t/all-cluster-instances-are-stopped-yet-their-process-is-alive/4972>\
**Category:** Zeek\
**Created:** [August 8, 2017, 8:32am UTC](https://community.zeek.org/t/all-cluster-instances-are-stopped-yet-their-process-is-alive/4972 "2017-08-08T08:32:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [August 8, 2017, 8:32am UTC](https://community.zeek.org/t/all-cluster-instances-are-stopped-yet-their-process-is-alive/4972/1 "2017-08-08T08:32:38Z")

</div>

Hi,

I am encountering a strange behavior here, I have a cluster (1 manager,1proxy,8 workers) and after a while :

- For some reason all of its instances appears as stopped

- In the spool directory, I see an empty debug.log, manager folder and NO workers\tmp\proxy folders

- Logs are still being written to the manager folder

- All of bro’s instances are actually still alive

I used to have a “broctl cron” task in crontab, but it has been commented out

I ran Broctl using root user, and I see that all of bro’s processes run as root.

any advice on this issue ?

Thanks

B

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [August 10, 2017, 3:21pm UTC](https://community.zeek.org/t/all-cluster-instances-are-stopped-yet-their-process-is-alive/4972/2 "2017-08-10T15:21:51Z")

</div>

I wonder if you have two different installations of Bro on your machine  
(such as /usr/local/bro and /usr/local/bro.old, for example).  
If so, you will need to be careful to use only one of them.

Also, be careful to not delete any files in the "spool"  
directory. Otherwise, broctl might lose track of the bro  
processes that it started.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/all-cluster-instances-are-stopped-yet-their-process-is-alive/4972/3 "2022-05-06T15:45:11Z")

</div>