Bro auto start at boot with Endace cards

Zeek
1

My recent Bro config is coming along nicely, but I have run into one issue.

I followed the normal method to start Bro at system boot (added /usr/local/bro/bin/broctl start to /etc/rc.local), but this has resulted in bro crashing due to device dag0:0 being “busy”. I find that two normal Bro processes are already started using this method, but broctl status indicates crashed. Attempts to start Bro fail until I kill the existing Bro PIDs. Once I do that, I can start Bro normally via broctl.

Is this an issue unique to Endace cards? A race condition with Dag load? Any ideas?

Brad Miller | Comerica Bank

Information Security Architecture

IT Security

Office: 248.371.4249 | Mobile: 920.378.8138

2

Brad,

That’s possible, given the amount of time that dagsetup can take to set up the cards. We have Bro start with a normal init script (not in rc.local), but have never had this happen to us, on our 9.2X2 cards.

v/r