Some broct cron errors

Zeek
1

Hi all,

In my Bro manager, under stats.log file I see the following errors:

1493044804.42 worker-2 parent vsize 104857600
1493044804.42 worker-2 parent cmd bro
1493044804.42 worker-2 parent pid 12753
1493044804.42 worker-2 parent cpu 0
1493044804.42 worker-2 parent rss 102760448
1493044804.42 worker-2 child vsize 91226112
1493044804.42 worker-2 child cmd bro
1493044804.42 worker-2 child pid 53186
1493044804.42 worker-2 child cpu 0
1493044804.42 worker-2 child rss 3702784
1493044804.42 worker-2 error error worker-2: capstats failed (error: 'vio0 -i vio2 -i vio3 -i vio4 -i vio7': No such device exists (BIOCSETIF failed: Device not configured))
1493044804.42 worker-1 error error worker-1: capstats failed (error: 'vio0 -i vio2 -i vio3 -i vio4 -i vio7': No such device exists (BIOCSETIF failed: Device not configured))

I have configured two worker nodes listening in several network interfaces. Executing broctl netstats doesn't return any error:

root@brmgr01:/nsm/bro/logs/stats# broctl netstats
   worker-1: 1493045533.403342 recvd=754293 dropped=0 link=754293
   worker-2: 1493045532.906071 recvd=685795 dropped=0 link=685795

I think the problem is with my worker's sections under node.cfg:

[worker-1]
type=worker
host=172.22.59.2
interface='vio0 -i vio2 -i vio3 -i vio4 -i vio7'

[worker-2]
type=worker
host=172.22.59.3
interface='vio0 -i vio2 -i vio3 -i vio4 -i vio7'

What am I doing wrong?

Bro is 2.5 release ...

Thanks

2

Capstats does not take multiple interface arguments. If you try
to give it multiple interface arguments, it will just use the last
one. For example, these two commands are equivalent:
capstats -i vio0 -i vio2
capstats -i vio2

The error message you're seeing is because the quotes
in your node.cfg are being passed directly to the
capstats command (so capstats thinks the interface
name is 'vio0 -i vio2 ...').