Where do I find broctl error logs?

I am running the beta on Mac OS, and I noticed broctl cron is not working anymore. I can run it manually, and other cron jobs run fine, but it seems to be failing in some way I can’t see in syslogs.

I suspect something in broctl needs to set the path [1], but I have no information on the failure to investigate further.

:Adam

[1] http://apple.stackexchange.com/questions/116566/cron-script-not-executing-on-mavericks

I noticed broctl cron is not working anymore.

I am encountering the same issue. I first noticed that if workers are dying, broctl cron won't kick those back in - finally it appear that broctl cron itself might not be running. (This is on FreeBSD)

Aashish

Perhaps there is a BSD only issue with broctl cron

I don't know anything about the issue, but if you enable debug in broctl's configuration, you should be able to see a debug.log in your spool directory.

I’d like to see some basic broctl error logging also. Right now I’m running additional con jobs for status. I’d also like to get broctl output logging as it happens. My scripts have to include 2>&1 piped to grep/awk to make it useful.

I'd like to see some basic broctl error logging also. Right now I'm running additional con jobs for status. I'd also like to get broctl output logging as it happens. My scripts have to include 2>&1 piped to grep/awk to make it useful.

Starting in 2.4 broctl has an API, there's no reason to pipe it to grep/awk for getting status

# PYTHONPATH=/usr/local/bro/lib/broctl python

from BroControl import broctl
b = broctl.BroCtl()
res = b.status()
res.ok

True

res.success_count

60

for node in res.nodes[:3]: print node

...
(<BroControl.node.Node instance at 0x2376290>, True, {'status': 'running', 'name': 'nids-dev2a-1', 'started': '29 Aug 21:41:04', 'pid': 18025, 'host': '10.1.1.40', 'type': 'worker'})
(<BroControl.node.Node instance at 0x2376320>, True, {'status': 'running', 'name': 'nids-dev2a-2', 'started': '29 Aug 21:41:04', 'pid': 18037, 'host': '10.1.1.40', 'type': 'worker'})
(<BroControl.node.Node instance at 0x2376368>, True, {'status': 'running', 'name': 'nids-dev2a-3', 'started': '29 Aug 21:41:04', 'pid': 18076, 'host': '10.1.1.40', 'type': 'worker'})

Alright. I’ll have to see about how to instrument that.

Thanks!