Greetings
I am (still) trying to get a working connection between some code I wrote using broccoli calls and bro. (The code is part of a larger project that uses bro for an interface because bro keeps track of state. and generates events for connections.) I thought I was making some headway with understanding the event loop in bro and the reception in broccoli. I added a print statement in the broccoli method __bro_sobject_data_get to try to understand why I couldn't read the payload correctly and recompiled broccoli. Now all communication has ceased and the bro debug.log shows "Resource temporarily unavailable" which must be a system error because there is no such string in bro or broccoli. This harkens back to a problem I had when I first tried to use 'broping'.
Can anyone offer me some pointers on how to track down what's causing the error? There's nothing in the system logs and I can't find any clues via google. I'm running RedHat 9 with kernel 2.4.20-6. bro and broccoli are running on the same system which is inside a firewall, so it only sees some local intranet traffic and the ssh, ftp, etc. connections I use to test from another Linux system inside the firewall. I am reaching the point where I will have to start the project over with some interface if I can't get this to work. Any help will be appreciated.
Thanks
Mike
Hi Mike,
(apologies for still not having fixed the bug in Bro that breaks one-way
event-relay functionality from a Bro node ... *sigh*.)
Greetings
I am (still) trying to get a working connection between some code I wrote
using broccoli calls and bro. (The code is part of a larger project that
uses bro for an interface because bro keeps track of state. and generates
events for connections.) I thought I was making some headway with
understanding the event loop in bro and the reception in broccoli. I added a
print statement in the broccoli method __bro_sobject_data_get to try to
understand why I couldn't read the payload correctly and recompiled
broccoli. Now all communication has ceased and the bro debug.log shows
"Resource temporarily unavailable" which must be a system error because
there is no such string in bro or broccoli. This harkens back to a problem I
had when I first tried to use 'broping'.
I have seen that error too (and I've filed it in the "weird symptoms"
category), but I need more information to be able to help you.
- Are you using SSL? Try without first, if so.
- I presume you're on the latest Bro developer release?
Also, I'll need to have a look at:
- The Broccoli client code.
- The output of the Broccoli client with call tracing and debugging
output enabled.
- The Bro invocation command and any policies you're running if they're
non-standard.
- Bro's comm.log, remote.log, and debug.log produced on a run that
triggered the problem.
For what it's worth, so far the problem has never been actual protocol
breakage (as in Bro sending some serialized data and Broccoli being
unable to parse it, and vice versa).
I'll look at it asap if you send me more info, though I'll be offline
over the weekend.
Best of luck,
Christian.