# (no subject)

**URL:** <https://community.zeek.org/t/no-subject/5664>\
**Category:** Zeek\
**Created:** [April 13, 2019, 7:50pm UTC](https://community.zeek.org/t/no-subject/5664 "2019-04-13T19:50:09Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Herakovic](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@Daniel\_Herakovic](https://community.zeek.org/u/Daniel_Herakovic)\
**Post date:** [April 13, 2019, 7:50pm UTC](https://community.zeek.org/t/no-subject/5664/1 "2019-04-13T19:50:09Z")

</div>

Hello,

I've been trying to get Zeek installed on a Clear linux distribution machine for a while. I know my way around linux enough to get this done from the github source, but what caused me so much trouble was a missing pre-requisite - the C++ Actor framework.

I'm not a linux beginner, and I installed all of the pre-requisits, but if this was added to the part of the instalation documentation under "To build Bro from source, the following additional dependencies are required:", installing from source would have been much smoother for me. If for some reason, this being left out is intentional, sorry to bring this up.

After setting up all of the. cfg files and runnung install and start in broctrl, I got the following error:  
‎  
cl@clr-31868b162a544d5290cfe54c3dd15df1 /usr/local/bro/logs/current $ cat stderr.log  
\*\*\* failed to set config parameter work-stealing.moderate-sleep-duration-us: invalid name  
\*\*\* failed to set config parameter work-stealing.relaxed-sleep-duration-us: invalid name  
/usr/local/bro/share/broctl/scripts/run-bro: line 110: 1211 Segmentation fault (core dumped) nohup "$mybro" "$@"‎

The proces did not start. Any suggestions how to solve this or any links to possibles hints for a solution would be appreciated.

I enjoyed the conference at Cern very much.

Thanks.

Dan.

---

<div class="post-metadata">

**Author:** ![Daniel\_Herakovic](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@Daniel\_Herakovic](https://community.zeek.org/u/Daniel_Herakovic)\
**Post date:** [April 14, 2019, 5:43pm UTC](https://community.zeek.org/t/no-subject/5664/2 "2019-04-14T17:43:17Z")

</div>

Hello,

Last night I wrote about adding C++ Actor framework as a pre-requisite in the installation manual. Today I tried to install zeek in on my osx and noticed it gets recursivley cloned from the zeek github repo. Sorry to bring this up.

I haven’t resolved the second question about getting a segmentation fault when running zeek. Any help will be appreciated.

Thanks.

Dan.

---

<div class="post-metadata">

**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\
**Post date:** [April 15, 2019, 9:13am UTC](https://community.zeek.org/t/no-subject/5664/3 "2019-04-15T09:13:31Z")

</div>

There is no need to manually compile Zeek on ClearLinux, as it is included in the distribution.

swupd bundle-add network-security-monitoring

And Zeek is installed. You want to work-around the Zeek/ClearLinux incompatibility next

/usr/bin/rsync -aP /usr/share/bro /tmp  
rm -rf /usr/share/bro  
/usr/bin/rsync -aP /tmp/bro /usr/share/  
ln -s /etc/bro/config/broctl.cfg /etc/broctl.cfg  
ln -s /etc/bro/config/networks.cfg /etc/networks.cfg  
ln -s /etc/bro/config/node.cfg /etc/node.cfg

Create the service user

useradd bro

chown -Rv bro:bro /var/lib/bro  
chown -Rv bro:bro /usr/share/broctl/scripts

su - bro

broctl deploy

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [April 15, 2019, 5:10pm UTC](https://community.zeek.org/t/no-subject/5664/4 "2019-04-15T17:10:47Z")

</div>

Getting a stack trace in a debugger (gdb / lldb) and sending that  
would give us more hints.

- Jon

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [April 15, 2019, 6:19pm UTC](https://community.zeek.org/t/no-subject/5664/5 "2019-04-15T18:19:41Z")

</div>

You installed CAF from somewhere? You likely just need to remove that  
and let zeek install the specific version that it includes in  
src/3rdparty/caf

---

<div class="post-metadata">

**Author:** ![Daniel\_Herakovic](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@Daniel\_Herakovic](https://community.zeek.org/u/Daniel_Herakovic)\
**Post date:** [April 16, 2019, 3:29pm UTC](https://community.zeek.org/t/no-subject/5664/6 "2019-04-16T15:29:42Z")

</div>

Hey,

I tried a fresh install from the github repo on duplicate hardware, with the included CAF, and didn't get any segmentation fault errors when running it. Now its running and logging properly. I assume the stack trace wont be necessary. If for some reason, you want the gdb/llbd stack trace, I have that install available.

Thank for your responses and suggestions.

Dan.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/no-subject/5664/7 "2022-05-06T15:46:26Z")

</div>


