# Bro is running, but ...

**URL:** <https://community.zeek.org/t/bro-is-running-but/1108>\
**Category:** Zeek\
**Created:** [January 16, 2007, 9:53am UTC](https://community.zeek.org/t/bro-is-running-but/1108 "2007-01-16T09:53:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thorkill](https://avatars.discourse-cdn.com/v4/letter/t/4af34b/32.png) [@Thorkill](https://community.zeek.org/u/Thorkill)\
**Post date:** [January 16, 2007, 9:53am UTC](https://community.zeek.org/t/bro-is-running-but/1108/1 "2007-01-16T09:53:02Z")

</div>

Hello everyone,  
and happy new year!

I am observing some wired things regarding to bro.

fw1-net1# /usr/local/etc/rc.d/bro.sh checkpoint  
bro.rc: Beginning the checkpoint process  
bro.rc: No current instance of Bro is running.

fw1-net1# ps -aux | grep bro  
root 157 0.0 0.1 1776 1124 ?? I Mon12AM 0:00.01 /bin/sh /usr/local/bro/etc/bro.rc start  
root 165 0.0 3.5 40340 36556 ?? S Mon12AM 42:12.20 /usr/local/bro/bin/bro -W -i re1 local.site.bro

I have to kill the bro process and start it again.  
I'm running bro 1.1c on FreeBSD 6.2-PRERELEASE.

We have custom rules which react to events using system(), and calling  
pfctl to extend specific tables in the firewall ruleset. Everything is working fine, but time to time, lets say one time a week, bro doesn't react as expected. We have logfiles that events ware there but tables are not extended to orign IP addresses.

Does anyone knows what can be wrong or maybe someone observed the same behavior?

The custom site-rule isn't different from conn.bro just triggered on specific traffic.

Regards,  
/rl

---

<div class="post-metadata">

**Author:** ![Brian\_Tierney](https://avatars.discourse-cdn.com/v4/letter/b/13edae/32.png) [@Brian\_Tierney](https://community.zeek.org/u/Brian_Tierney)\
**Post date:** [January 17, 2007, 5:07pm UTC](https://community.zeek.org/t/bro-is-running-but/1108/2 "2007-01-17T17:07:52Z")

</div>

Have you set the env variable BROHOME?

This script looks for PID of the current bro to kill by looking

---

<div class="post-metadata">

**Author:** ![Thorkill](https://avatars.discourse-cdn.com/v4/letter/t/4af34b/32.png) [@Thorkill](https://community.zeek.org/u/Thorkill)\
**Post date:** [January 18, 2007, 8:41am UTC](https://community.zeek.org/t/bro-is-running-but/1108/3 "2007-01-18T08:41:46Z")

</div>

Brian Tierney wrote:

> Have you set the env variable BROHOME?
> 
> This script looks for PID of the current bro to kill by looking  
> at BRO\_RUNTIME\_DIR, which is defined in $BROHOME/etc/bro.cfg

Of course, everything is working fine for few days and then happens what I described in my last email.

fw1-net1# ./bro.sh status  
Bro is running (pid: 66617)  
Autorestart: ON  
Running since: Thu Jan 18 04:03:04 UTC 2007  
Bro Version: 1.1c  
Active log suffix: fw1-net1.07-01-18\_04.03.01

I'm now restarting bro using cron for test once a day.

thx,  
/rl

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/bro-is-running-but/1108/4 "2022-05-06T15:38:08Z")

</div>