analysis-groups

Hello.

We're in the process of upgrading our IDS infrastructure here, and I've
been trying for the last week or so to get the "release" version of bro
up and running. It refuses and then it shames me. First, I'll detail
what I've tried, and then I'll tell you where I'm stuck.

I downloaded the "release" version of 1.4, thinking it would be a breeze
to install like 1.3 was.

I attempted to compile and install it, only to find out that the part
that actually allows it to install and run (bro-lite) was not only
deprecated, but was helpfully disabled as shipped in order to prevent me
from blundering into an unsupportable situation.

I read a huge chunk of the mailing list archives and determined that in
order to use the "release" version of bro, I would have to install a
bleeding-edge clustering component, as a test of my mettle.

I followed the instructions at
http://blog.ncsa.uiuc.edu/aashish/2008/10/21/moving-to-bro-14/ and
compiled the clustering component, running it in standalone mode.

When I try running the clustering component, it complains that it
doesn't have the analysis-groups.bro component, which appears to be part
of some changes made to the policy files but only made available to some
inner cabal of bro developers.

Not to be thwarted, I used Google to try to find out about the file, and
found a hidden copy in the web interface of the SVN repository. Naively
thinking this would solve my problem, I installed it
in /usr/local/bro/current/policy/local/ and was finally able to get bro
to start without instantly dying.

That brings me to right now, where I'm stuck. Bro will run for a few
minutes, generating the usual mass of data before suddenly deciding to
segfault and die. As best I can tell, it's dying in
DNS_Mgr::Process() . I'm guessing that's not normal behavior, or
someone else would probably have emailed about it.

Any ideas on how to get a working install of bro 1.4?

Thanks for your help, and for writing it in the first place,

-Lou
(hoping for more to put on his 2008-2009 performance evaluation than
"heroically spent FY08-09 compiling bro over and over again.")

up and running. It refuses and then it shames me. First, I'll detail
what I've tried, and then I'll tell you where I'm stuck.

I'm sorry about the trouble but you're actually mixing multiple
things here.

I attempted to compile and install it, only to find out that the part
that actually allows it to install and run (bro-lite) was not only
deprecated, but was helpfully disabled as shipped in order to prevent me
from blundering into an unsupportable situation.

The bro-lite install is indeed broken in 1.4 but there's a patch in
our tracker which seems to fix the issue; see
http://tracker.icir.org/bro/ticket/51 . Please try this and let me
know if it works for you.

I read a huge chunk of the mailing list archives and determined that in
order to use the "release" version of bro, I would have to install a
bleeding-edge clustering component, as a test of my mettle.

The cluster shell scripts are supposed to be used only with my
development branch for now. Using them with 1.4 may or may not work,
I don't know.

Not to be thwarted, I used Google to try to find out about the file, and
found a hidden copy in the web interface of the SVN repository.

Well, it's not exactly hidden. If you'd checked out the development
branch (see above), you would have had it.

segfault and die. As best I can tell, it's dying in
DNS_Mgr::Process() . I'm guessing that's not normal behavior, or
someone else would probably have emailed about it.

Hard to tell what this is without further information. There's a
blog posting at

describing how to get more context for such problems. In particular,
a stack backtrace would be helpful here.

Robin