# Likely bug in broctl

**URL:** <https://community.zeek.org/t/likely-bug-in-broctl/4779>\
**Category:** Zeek\
**Created:** [April 15, 2017, 4:17am UTC](https://community.zeek.org/t/likely-bug-in-broctl/4779 "2017-04-15T04:17:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![LinuxBSDos.com](https://avatars.discourse-cdn.com/v4/letter/l/87869e/32.png) [@LinuxBSDos.com](https://community.zeek.org/u/LinuxBSDos.com)\
**Post date:** [April 15, 2017, 4:17am UTC](https://community.zeek.org/t/likely-bug-in-broctl/4779/1 "2017-04-15T04:17:14Z")

</div>

Hello:

On an Ubuntu 16.04 server, I have Bro executables in /usr/local/bro/bin, which is in the PATH of all users on the system.

As root, I can invoke all the commands by just specifying the relative paths. As a standard user, I can do the same for the commands except broctl. If I type, for example, "broctl --h", it returns the following error messages:

\<error\>  
Traceback (most recent call last):  
&nbsp;&nbsp;&nbsp;File "/usr/local/bro/bin/broctl", line 830, in \<module\>  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sys.exit(main())  
&nbsp;&nbsp;&nbsp;File "/usr/local/bro/bin/broctl", line 797, in main  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;loop = BroCtlCmdLoop(BroCtl, interactive, cmd)  
&nbsp;&nbsp;&nbsp;File "/usr/local/bro/bin/broctl", line 25, in \_\_init\_\_  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;self.broctl = broctl\_class(ui=self)  
&nbsp;&nbsp;&nbsp;File "/usr/local/bro/lib/broctl/BroControl/broctl.py", line 69, in \_\_init\_\_  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;level=logging.DEBUG)  
&nbsp;&nbsp;&nbsp;File "/usr/lib/python2.7/logging/\_\_init\_\_.py", line 1547, in basicConfig  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;hdlr = FileHandler(filename, mode)  
&nbsp;&nbsp;&nbsp;File "/usr/lib/python2.7/logging/\_\_init\_\_.py", line 913, in \_\_init\_\_  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;StreamHandler.\_\_init\_\_(self, self.\_open())  
&nbsp;&nbsp;&nbsp;File "/usr/lib/python2.7/logging/\_\_init\_\_.py", line 943, in \_open  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;stream = open(self.baseFilename, self.mode)  
IOError: [Errno 13] Permission denied: '/usr/local/bro/spool/debug.log'  
\</error\>

"Permission denied" seems to make sense, but if I type "sudo broctl --h", I get "sudo: broctl: command not found".

It only works if I specify the full path with sudo, so "sudo /usr/local/bro/bin/broctl --h" works, but "/usr/local/bro/bin/broctl --h" does not.

Again, this is just for broctl.

Thanks,

-finid-

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [April 15, 2017, 4:48am UTC](https://community.zeek.org/t/likely-bug-in-broctl/4779/2 "2017-04-15T04:48:42Z")

</div>

If you upgrade to the newest release of Bro, then  
the error message is more user-friendly.

The error is due to the fact that broctl needs to  
write to the "spool" and "logs" directories.  
This is explained in the broctl documentation:  
[https://www.bro.org/sphinx/components/broctl/README.html#using-brocontrol-as-an-unprivileged-user](https://www.bro.org/sphinx/components/broctl/README.html#using-brocontrol-as-an-unprivileged-user)

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [April 15, 2017, 11:12am UTC](https://community.zeek.org/t/likely-bug-in-broctl/4779/3 "2017-04-15T11:12:02Z")

</div>

> ```auto
> If you upgrade to the newest release of Bro, then
> the error message is more user-friendly.
> 
> The error is due to the fact that broctl needs to
> write to the "spool" and "logs" directories.
> This is explained in the broctl documentation:
> [https://www.bro.org/sphinx/components/broctl/README.html#using-brocontrol-as-an-unprivileged-user
> 
> ](https://www.bro.org/sphinx/components/broctl/README.html#using-brocontrol-as-an-unprivileged-user
> 
> )
> 
> ```

And as for /usr/local/bro/bin, add that to your secure\_path= line in /etc/sudoers file.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/likely-bug-in-broctl/4779/4 "2022-05-06T15:44:50Z")

</div>


