Worker-1-6 always crashes when starting

Zeek
1

Hello, I’m just starting out with zeek, running a 7.0.2 cluster on a single host with 28 cores. I’m having an issue where worker-1-6 always crashes when starting with error:

fatal error: Failed to setup Prometheus endpoint: null context when constructing CivetServer. Possible problem binding to port. Error: Failed to setup server ports. Attempted to bind to 0.0.0.0:9999.

The worker entry for my node.cfg is:

[worker-1]
type=worker
host=localhost
interface=eno49
lb_method=pf_ring
lb_procs=23
pin_cpus=5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27

All other workers work fine, no matter how many I run. I tried splitting it into two worker sections, worker-1-1 to 5 and worker-2-1 to 18, and worker-2-1 crashed just the same as if it were worker-1-6.

Currently I’m unsure where to find the crash reports Zeek says it’s generating when I stop it.

2

Do you already have something running on port 9999? You can look to see if you do with this command…

netstat -an  | grep 9999
3

It seems that I do:

tcp        0      0 0.0.0.0:9999            0.0.0.0:*               LISTEN

No idea what it is that’s listening on port 9999, or why worker-1-6 is either the only one to try to connect on port 9999 or the only one that cares something else is listening on it.

4

You can find the process listening like this…

sudo lsof -i -n -P | grep 9999
5

Ok I found the process:

ntop-lice    930                     root    8u  IPv4  12895      0t0  TCP *:9999 (LISTEN)

it’s ntop, which would be related to my installation of pf_ring. I suspect it has to do with licencing. I didn’t notice at the bottom of the installation instructions page for ntop it said that nprobe and n2disk required licences. I just installed all the packages it listed on the intruction page. Removing the package ntop-license also removed nprobe and n2disk as well as ntopng, but zeek is working fine now so I guess those packages weren’t needed.

Thanks much!