can not start bro

Zeek
1

I had a series of problems on one sensor (disk full and consequent issues) and now when I try

broctl start

it tries to start the manager and just hangs.

rful011@secmontst01:/opt/bro/etc$ sudo broctl start
warning: removing stale lock
starting manager …

after killing it I find:

rful011@secmontst01:/opt/bro/etc$ cat ~sensors/data/dmzo/bro-spool/manager/stderr.log
nohup: failed to run command `/run-bro': No such file or directory

timestamp is current.

Bro is installed using securityoinion-bro — I have tried removing and installing it again but it does not make any difference.

Any ideas on what to look for.

Russell

2

You probably forgot to run "broctl install".

-Daniel

3

You probably forgot to run "broctl install”.

I’m an idiot! but it would be nice if broctl start did some sanity checking!

I manage my sensors with puppet — I need to add and exec to run broctl install if the bro-spool/installed-scripts… does not exist after the config files are put in place.

4

You should try this Puppet module: https://forge.puppetlabs.com/panaman/bro

  --Vlad