# What does it means this alert?

**URL:** <https://community.zeek.org/t/what-does-it-means-this-alert/2473>\
**Category:** Zeek\
**Created:** [October 30, 2012, 9:09am UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473 "2012-10-30T09:09:41Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![C\_L\_Martinez](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@C\_L\_Martinez](https://community.zeek.org/u/C_L_Martinez)\
**Post date:** [October 30, 2012, 9:09am UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473/1 "2012-10-30T09:09:41Z")

</div>

Hi all,

I have installed bro-ids components on a CentOS 6.3 host. All works  
as expected but from time to time I am receiving alerts like this:

nice: which:: No such file or directory

---

<div class="post-metadata">

**Author:** ![C\_L\_Martinez](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@C\_L\_Martinez](https://community.zeek.org/u/C_L_Martinez)\
**Post date:** [October 31, 2012, 9:05am UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473/2 "2012-10-31T09:05:20Z")

</div>

It seems that the alert is triggered when bro rotates logs ... Is it  
possible to avoid this alert??

---

<div class="post-metadata">

**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\
**Post date:** [October 31, 2012, 4:21pm UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473/3 "2012-10-31T16:21:17Z")

</div>

Haven’t delved into this, but it appears to be a path problem - is the ‘which’ command in the path?

---

<div class="post-metadata">

**Author:** ![C\_L\_Martinez](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@C\_L\_Martinez](https://community.zeek.org/u/C_L_Martinez)\
**Post date:** [October 31, 2012, 6:11pm UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473/4 "2012-10-31T18:11:40Z")

</div>

Yes, it is under /usr/bin.

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [October 31, 2012, 6:28pm UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473/5 "2012-10-31T18:28:43Z")

</div>

I think the problem is the nice command. Is that in your path?

.Seth

---

<div class="post-metadata">

**Author:** ![C\_L\_Martinez](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@C\_L\_Martinez](https://community.zeek.org/u/C_L_Martinez)\
**Post date:** [November 2, 2012, 6:50am UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473/6 "2012-11-02T06:50:11Z")

</div>

Sorry for the delayed response. I've been out of the office until today.

Yes, nice is in my path:

[root@nsm01 spool]# whereis nice  
nice: /bin/nice /usr/share/man/man1/nice.1.gz

But the problem is with "time" command, as Chuck says in another thread:

[http://mailman.icsi.berkeley.edu/pipermail/bro/2012-October/005962.html](http://mailman.icsi.berkeley.edu/pipermail/bro/2012-October/005962.html)

In my broctl-config.sh appears this:

bindir="/nsm/bro/bin"  
time="which: no time in  
(/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin)"

I have changed to:

time="/usr/bin/time"

So far the message has not been repeated.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/what-does-it-means-this-alert/2473/7 "2022-05-06T15:40:38Z")

</div>