My continuing lock file issue

Zeek
1

So,

I have now reinstalled bro completely (from source, there is a dependency issue with libc with the binary install), wiped the nodes clean and rebuilt all directories, established the ssh connections for the bro user. When I go into broctl I still am getting the cannot get lock issue.

I do notice that when I go into /usr/local/bro/spool, I get some files showing up being owned by root, and it doesn’t seem it should be.

drwxr-xr-x 4 bro bro 4096 May 31 11:35 .

drwxr-xr-x 9 bro bro 4096 May 31 11:33 …

-rw-r–r-- 1 root root 82 May 31 11:35 broctl.dat

drwxr-xr-x 2 bro bro 4096 May 31 11:33 scripts

-rw-r–r-- 1 root root 445 May 31 11:35 stats.log

drwxr-xr-x 2 bro bro 4096 May 31 11:33 tmp

James Richards

Office of Security

Wisconsin Department of Administration

608.224.3880

2

Just a guess: is "broctl cron" executed from the system crontab?

Robin

3

It was, under var/spool/cron/crontabs.

I got rid of the entries, and broctl now works flawlessly.

But now my nodes won't start, I can see the 'install' command happily updating the nodes via ssh, but they won't start. So I started to chase it down via the scripts to run at startup (smtp, connections, software, etc.), so I copied the sites/local.bro from an older subdirectory (previous install) to my new install, but now manager is stopping with an error.

No replies necessary, as I think I am almost there.

Thanks all for your help, it is appreciated, and I have learned a bunch.

James Richards
Office of Security
Wisconsin Department of Administration
608.224.3880