# Just getting started **URL:** \ **Category:** Zeek\ **Created:** [January 9, 2013, 7:03pm UTC](https://community.zeek.org/t/just-getting-started/2532 "2013-01-09T19:03:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Paul\_Schmehl1](https://avatars.discourse-cdn.com/v4/letter/p/779978/32.png) [@Paul\_Schmehl1](https://community.zeek.org/u/Paul_Schmehl1)\ **Post date:** [January 9, 2013, 7:03pm UTC](https://community.zeek.org/t/just-getting-started/2532/1 "2013-01-09T19:03:02Z")
I just installed Bro (on FreeBSD 8.3) and got it up and running. I'm working my way through the docs, and I decided to do the local.bro edit for the Invalid SSL Certs that's described in the docs. However, when I launched broctl and typed check, I got this: waiting for lock ..................................cannot get lock I got the same thing when I typed stop as well as diag. When I started broctl initially, I typed "install" and then "start". Then I closed broctl. Apparently you're supposed to leave broctl running? If so, that seems rather inconvenient. ---
**Author:** ![Castle\_Shane](https://avatars.discourse-cdn.com/v4/letter/c/3ab097/32.png) [@Castle\_Shane](https://community.zeek.org/u/Castle_Shane)\ **Post date:** [January 9, 2013, 7:28pm UTC](https://community.zeek.org/t/just-getting-started/2532/2 "2013-01-09T19:28:08Z")
You must use sudo: "sudo broctl check". Followed by rinse, spin (install, restart). 😉 Unless you're already root. That message is the result I always get when I forget sudo. ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 9, 2013, 7:40pm UTC](https://community.zeek.org/t/just-getting-started/2532/3 "2013-01-09T19:40:13Z")
No, it's not supposed to be running, however it sounds like a previous run didn't terminate. Did you do the crontab entry as described in the docs? If so, it could be that the cron job was just running as you tried to check the config; there can only be one broctl at a time. But if the problem persists, an earlier broctl process probably hangs; check with ps and just kill it. Robin ---
**Author:** ![Paul\_Schmehl1](https://avatars.discourse-cdn.com/v4/letter/p/779978/32.png) [@Paul\_Schmehl1](https://community.zeek.org/u/Paul_Schmehl1)\ **Post date:** [January 9, 2013, 7:42pm UTC](https://community.zeek.org/t/just-getting-started/2532/4 "2013-01-09T19:42:52Z")
> You must use sudo: "sudo broctl check". Followed by rinse, spin (install, > restart). 😉 > > Unless you're already root. I am. > That message is the result I always get when I forget sudo. Good to know. In my case it was caused by exiting out of broctl by using Control-C instead of typing exit. Once I figured that out, all was well. Now if I can just figure out what to do with bro..... 🙂 ---
**Author:** ![Vlad\_Grigorescu2](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@Vlad\_Grigorescu2](https://community.zeek.org/u/Vlad_Grigorescu2)\ **Post date:** [January 9, 2013, 8:13pm UTC](https://community.zeek.org/t/just-getting-started/2532/5 "2013-01-09T20:13:02Z")
> > You must use sudo: "sudo broctl check". Followed by rinse, spin (install, > > restart). 😉 > > > > Unless you're already root. > > I am. I actually avoid running bro as root. I create a bro user, and have it run as that instead. Apart from making sure that \ has the right permissions, I just need to set the privileges as mentioned in the documentation[1]: > sudo setcap cap\_net\_raw,cap\_net\_admin=eip \/bin/bro If anyone's interested, I have a very much work-in-progress Puppet module for setting up the Bro directories with the proper permissions.   --Vlad 1 - \<[http://www.bro-ids.org/bro-workshop-2011/exercises/getting-started/index.html>](http://www.bro-ids.org/bro-workshop-2011/exercises/getting-started/index.html>); ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [January 9, 2013, 10:30pm UTC](https://community.zeek.org/t/just-getting-started/2532/6 "2013-01-09T22:30:50Z")
A Puppet module would be really good. I too run as “bro” and it’s obnoxious because after the beautiful simplicity of “broctl install” to update code for each node, I then have to do a bash loop to SSH in to each node and manually setcap, and only then can I perform the “start.” ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/just-getting-started/2532/7 "2022-05-06T15:40:44Z")