My recent Bro config is coming along nicely, but I have run into one issue.
I followed the normal method to start Bro at system boot (added /usr/local/bro/bin/broctl start to /etc/rc.local), but this has resulted in bro crashing due to device dag0:0 being “busy”. I find that two normal Bro processes are already started using this method, but broctl status indicates crashed. Attempts to start Bro fail until I kill the existing Bro PIDs. Once I do that, I can start Bro normally via broctl.
Is this an issue unique to Endace cards? A race condition with Dag load? Any ideas?
Brad Miller | Comerica Bank
Information Security Architecture
Office: 248.371.4249 | Mobile: 920.378.8138