can not start bro

I had a series of problems on one sensor (disk full and consequent issues) and now when I try

broctl start

it tries to start the manager and just hangs.

rful011@secmontst01:/opt/bro/etc$ sudo broctl start
warning: removing stale lock
starting manager …

after killing it I find:

rful011@secmontst01:/opt/bro/etc$ cat ~sensors/data/dmzo/bro-spool/manager/stderr.log
nohup: failed to run command `/run-bro': No such file or directory

timestamp is current.

Bro is installed using securityoinion-bro — I have tried removing and installing it again but it does not make any difference.

Any ideas on what to look for.


You probably forgot to run "broctl install".


You probably forgot to run "broctl install”.

I’m an idiot! but it would be nice if broctl start did some sanity checking!

I manage my sensors with puppet — I need to add and exec to run broctl install if the bro-spool/installed-scripts… does not exist after the config files are put in place.

You should try this Puppet module: