Install issue - Bro cluster

Zeek
1

Greetings all,

I'm having an issue with the install of Bro via cluster mode. I receive this error when I run make install-broctl:

( cd aux/broctl && make install-broctl )
make[1]: Entering directory `/home/bro1/bro/bro-1.5.2/aux/broctl'
MAKE_DESTDIR= ./bin/make-wrapper install --make
error: script must be run on manager node
make[1]: *** [install-broctl] Error 1
make[1]: Leaving directory `/home/bro1/bro/bro-1.5.2/aux/broctl'
make: *** [install-broctl] Error 2

This is on the machine I will use as the Managing / Proxy. I also have 2 other machines set as workers (they installed fine - No issues)

Any ideas?

Thanks,

=-=Blake

2

Blake,

Do you have an existing Bro installation at your target install location?
I think I ran into this when I had 1.5.1 installation and tried to put
1.5.2 on top of it. If you can't remove the existing install I'd try
creating/editing your etc/node.cfg and setting the current system as the
manager.

Then next thing you'll want to do is edit
share/bro/broctl/cluster-addrs.hot.bro and comment out line 3 (the only
line).

-Dop

3

Thanks for the info,

I did as you said, and the recompile and install went well.
(no errors) But now I seem to get an error when trying to start /usr/loca/bro/bin/./broctl

# ./broctl
error: script must be run on manager node

here is what the node.cfg looks like:

manager]
type=manager
host=is-bro1.is

[proxy-1]
type=proxy
host=is-bro1.is

[worker-1]
type=worker
host=is-bro2.is
interface=eth2

[worker-2]
type=worker
host=is-bro3.is
interface=eth2

Thanks,

=-=Blake

4

Blake,

Are running this on a linux machine and are you running broctl as root?

In my install I would get this error if /sbin was not in my path.

Michael Waite
Enterprise Security Analyst
Enterprise Information Privacy and Security Services (EIPSs)
Security Operations and Services (SOS)
Information Technology Services (ITS)
The Pennsylvania State University (PSU)

Direct Telephone: 814-865-2297
ITS-SOS Telephone: 814-863-9533
ITS-SOS E-Mail: security@psu.edu

5

Yep, that's the problem. You need to make sure that the ifconfig binary is in your path before running broctl. I'll file a ticket now to make sure we address that before the next release.

.Seth

6

Mike,

Yes, this is a Linux setup RHEL 5.5 - and the user is root (not the safest but it will work for the test purpose).

Thanks

=-=Blake

7

Actually we have already:

    http://tracker.icir.org/bro/ticket/293

Robin

8

I think I set the /sbin correctly. Now I get this error:

[root@is-bro1 bin]# ./broctl install
error: cannot use localhost/127.0.0.1 for manager host in nodes configuration

Thanks,

=-=Blake

9

Blake,

I was running into the same issues you are facing when first setting up my bro cluster. I just took a peek at my nodes.cfg and instead of using localhost or 127.0.0.1 to represent the manager/proxy, I used the IP that the worker nodes saw the manager at. I see you are using hostnames instead of IP addresses for this, so I don't know how much help this will be, but this works for me.

I also am not sure if this is the best method, but I can confirm it works.

Sam

10

Oops, totally missed that one.

  .Seth