I posted this to the SO list, but haven’t received any responses, so wanted to post here too.
Anytime I need to reboot my SO box, Bro tries to start normally but then terminates and I get crash alerts. They seem to point to something with the cluster layout, but I’m not sure how to fix it or why it started.
I usually need to a couple rounds of broctl deploy, kill bro, then do the same and it eventually starts fine.
This Bro 2.4 under Security Onion
See the crash log below–any ideas or help is much appreciated
Crash Report from Manager:
Bro 2.4
Linux 3.2.0-88-generic
==== No reporter.log
==== stderr.log
fatal error in /opt/bro/share/bro/base/frameworks/cluster/load.bro, line 16: can’t find cluster-layout
==== stdout.log
max memory size (kbytes, -m) unlimited
data seg size (kbytes, -d) unlimited
virtual memory (kbytes, -v) unlimited
core file size (blocks, -c) unlimited
==== .cmdline
-U .status -p broctl -p broctl-live -p local -p manager local.bro broctl base/frameworks/cluster local-manager.bro broctl/auto
==== .env_vars
PATH=/opt/bro/bin:/opt/bro/share/broctl/scripts:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
BROPATH=/nsm/bro/spool/installed-scripts-do-not-touch/site::/nsm/bro/spool/installed-scripts-do-not-touch/auto:/opt/bro/share/bro:/opt/bro/share/bro/policy:/opt/bro/share/bro/site
CLUSTER_NODE=manager
==== .status
TERMINATED [atexit]
==== No prof.log
==== No packet_filter.log
==== No loaded_scripts.log