# analysis-groups **URL:** \ **Category:** Zeek\ **Created:** [March 3, 2009, 9:03pm UTC](https://community.zeek.org/t/analysis-groups/1495 "2009-03-03T21:03:05Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Lou\_Ruppert1](https://avatars.discourse-cdn.com/v4/letter/l/73ab20/32.png) [@Lou\_Ruppert1](https://community.zeek.org/u/Lou_Ruppert1)\ **Post date:** [March 3, 2009, 9:03pm UTC](https://community.zeek.org/t/analysis-groups/1495/1 "2009-03-03T21:03:05Z")
Hello. We're in the process of upgrading our IDS infrastructure here, and I've been trying for the last week or so to get the "release" version of bro up and running. It refuses and then it shames me. First, I'll detail what I've tried, and then I'll tell you where I'm stuck. I downloaded the "release" version of 1.4, thinking it would be a breeze to install like 1.3 was. I attempted to compile and install it, only to find out that the part that actually allows it to install and run (bro-lite) was not only deprecated, but was helpfully disabled as shipped in order to prevent me from blundering into an unsupportable situation. I read a huge chunk of the mailing list archives and determined that in order to use the "release" version of bro, I would have to install a bleeding-edge clustering component, as a test of my mettle. I followed the instructions at [http://blog.ncsa.uiuc.edu/aashish/2008/10/21/moving-to-bro-14/](http://blog.ncsa.uiuc.edu/aashish/2008/10/21/moving-to-bro-14/) and compiled the clustering component, running it in standalone mode. When I try running the clustering component, it complains that it doesn't have the analysis-groups.bro component, which appears to be part of some changes made to the policy files but only made available to some inner cabal of bro developers. Not to be thwarted, I used Google to try to find out about the file, and found a hidden copy in the web interface of the SVN repository. Naively thinking this would solve my problem, I installed it in /usr/local/bro/current/policy/local/ and was finally able to get bro to start without instantly dying. That brings me to right now, where I'm stuck. Bro will run for a few minutes, generating the usual mass of data before suddenly deciding to segfault and die. As best I can tell, it's dying in DNS\_Mgr::Process() . I'm guessing that's not normal behavior, or someone else would probably have emailed about it. Any ideas on how to get a working install of bro 1.4? Thanks for your help, and for writing it in the first place, -Lou (hoping for more to put on his 2008-2009 performance evaluation than "heroically spent FY08-09 compiling bro over and over again.") ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 3, 2009, 11:02pm UTC](https://community.zeek.org/t/analysis-groups/1495/2 "2009-03-03T23:02:25Z")
> up and running. It refuses and then it shames me. First, I'll detail > what I've tried, and then I'll tell you where I'm stuck. I'm sorry about the trouble but you're actually mixing multiple things here. > I attempted to compile and install it, only to find out that the part > that actually allows it to install and run (bro-lite) was not only > deprecated, but was helpfully disabled as shipped in order to prevent me > from blundering into an unsupportable situation. The bro-lite install is indeed broken in 1.4 but there's a patch in our tracker which seems to fix the issue; see [http://tracker.icir.org/bro/ticket/51](http://tracker.icir.org/bro/ticket/51) . Please try this and let me know if it works for you. > I read a huge chunk of the mailing list archives and determined that in > order to use the "release" version of bro, I would have to install a > bleeding-edge clustering component, as a test of my mettle. The cluster shell scripts are supposed to be used only with my development branch for now. Using them with 1.4 may or may not work, I don't know. > Not to be thwarted, I used Google to try to find out about the file, and > found a hidden copy in the web interface of the SVN repository. Well, it's not exactly hidden. If you'd checked out the development branch (see above), you would have had it. > segfault and die. As best I can tell, it's dying in > DNS\_Mgr::Process() . I'm guessing that's not normal behavior, or > someone else would probably have emailed about it. Hard to tell what this is without further information. There's a blog posting at > **[How to Report a Bro Problem](http://blog.icir.org/2009/01/how-to-report-bro-problem.html)** > > Generally, when you see Bro doing something you believe it shouldn't, the best thing to do is opening a ticket in the Bro tracker , includi... describing how to get more context for such problems. In particular, a stack backtrace would be helpful here. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/analysis-groups/1495/3 "2022-05-06T15:38:52Z")