# Zeek keeps crashing due to some weird error message

**URL:** <https://community.zeek.org/t/zeek-keeps-crashing-due-to-some-weird-error-message/6754>\
**Category:** Zeek\
**Created:** [October 17, 2022, 1:56am UTC](https://community.zeek.org/t/zeek-keeps-crashing-due-to-some-weird-error-message/6754 "2022-10-17T01:56:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![espressobeanies](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@espressobeanies](https://community.zeek.org/u/espressobeanies)\
**Post date:** [October 17, 2022, 1:56am UTC](https://community.zeek.org/t/zeek-keeps-crashing-due-to-some-weird-error-message/6754/1 "2022-10-17T01:56:13Z")

</div>

I keep getting crashes every time I try to start Zeek. I suspect my config files are up to no good b/c I blew away my previous instance for the latest version:

> ZeekLogs]# zeekctl diag  
> [zeek]
> 
> No core file found.
> 
> Zeek 5.0.2  
> Linux 5.19.12-100.fc35.aarch64
> 
> Zeek plugins: (none found)
> 
> ==== reporter.log  
> #separator \x09  
> #set\_separator ,  
> #empty\_field (empty)  
> #unset\_field -  
> #path reporter  
> #open 2022-10-16-21-40-43  
> #fields ts level message location
> 
> ==== stderr.log  
> listening on eth0
> 
> _error in /usr/local/zeek/spool/installed-scripts-do-not-touch/auto/standalone-layout.zeek, line 6: Failed to listen on INADDR\_ANY:47760 (Broker::listen(Broker::default\_listen\_address, Broker::default\_port, Broker::default\_listen\_retry))_  
> _fatal error: errors occurred while initializing_
> 
> ==== stdout.log  
> max memory size (kbytes, -m) unlimited  
> data seg size (kbytes, -d) unlimited  
> virtual memory (kbytes, -v) unlimited  
> core file size (blocks, -c) unlimited
> 
> ==== .cmdline  
> -i eth0 -U .status -p zeekctl -p zeekctl-live -p standalone -p local -p zeek local.zeek zeekctl zeekctl/standalone zeekctl/auto
> 
> ==== .env\_vars  
> PATH=/usr/local/zeek/bin:/usr/local/zeek/share/zeekctl/scripts:/root/.local/bin:/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/usr/local/zeek/bin/  
> ZEEKPATH=/usr/local/zeek/spool/installed-scripts-do-not-touch/site::/usr/local/zeek/spool/installed-scripts-do-not-touch/auto:/usr/local/zeek/share/zeek:/usr/local/zeek/share/zeek/policy:/usr/local/zeek/share/zeek/site:/usr/local/zeek/share/zeek/builtin-plugins  
> CLUSTER\_NODE=
> 
> ==== .status  
> TERMINATED [fatal\_error]
> 
> ==== No prof.log
> 
> ==== packet\_filter.log  
> #separator \x09  
> #set\_separator ,  
> #empty\_field (empty)  
> #unset\_field -  
> #path packet\_filter  
> #open 2022-10-16-21-40-43  
> #fields ts node filter init success  
> #types time string string bool bool
> 
> ==== loaded\_scripts.log  
> #separator \x09  
> #set\_separator ,  
> #empty\_field (empty)  
> #unset\_field -  
> #path loaded\_scripts  
> #open 2022-10-16-21-40-43  
> #fields name  
> #types string

Config files:

networks.cfg

```auto
# List of local networks in CIDR notation, optionally followed by a
# descriptive tag.
# For example, "10.0.0.0/8" or "fe80::/64" are valid prefixes.

192.168.1.1/24 Internal_IP_space
xxx.xxx.xxx.xxx/32 External_IP_address

```

node.cfg:

```auto
# Example ZeekControl node configuration.
#
# This example has a standalone node ready to go except for possibly changing
# the sniffing interface.

# This is a complete standalone configuration. Most likely you will
# only need to change the interface.
[zeek]
type=standalone
host=localhost
interface=eth0

```

zeekctl.cfg:

```auto
## Global ZeekControl configuration file.

###############################################
# Mail Options

# Recipient address for all emails sent out by Zeek and ZeekControl.
MailTo = root@localhost

# Mail connection summary reports each log rotation interval. A value of 1
# means mail connection summaries, and a value of 0 means do not mail
# connection summaries. This option has no effect if the trace-summary
# script is not available.
MailConnectionSummary = 1

# Lower threshold (in percentage of disk space) for space available on the
# disk that holds SpoolDir. If less space is available, "zeekctl cron" starts
# sending out warning emails. A value of 0 disables this feature.
MinDiskSpace = 5

# Send mail when "zeekctl cron" notices the availability of a host in the
# cluster to have changed. A value of 1 means send mail when a host status
# changes, and a value of 0 means do not send mail.
MailHostUpDown = 1

###############################################
# Logging Options

# Rotation interval in seconds for log files on manager (or standalone) node.
# A value of 0 disables log rotation.
LogRotationInterval = 3600

# Expiration interval for archived log files in LogDir. Files older than this
# will be deleted by "zeekctl cron". The interval is an integer followed by
# one of these time units: day, hr, min. A value of 0 means that logs
# never expire.
LogExpireInterval = 0

# Enable ZeekControl to write statistics to the stats.log file. A value of 1
# means write to stats.log, and a value of 0 means do not write to stats.log.
StatsLogEnable = 1

# Number of days that entries in the stats.log file are kept. Entries older
# than this many days will be removed by "zeekctl cron". A value of 0 means
# that entries never expire.
StatsLogExpireInterval = 0

###############################################
# Other Options

# Show all output of the zeekctl status command. If set to 1, then all output
# is shown. If set to 0, then zeekctl status will not collect or show the peer
# information (and the command will run faster).
StatusCmdShowAll = 0

# Number of days that crash directories are kept. Crash directories older
# than this many days will be removed by "zeekctl cron". A value of 0 means
# that crash directories never expire.
CrashExpireInterval = 0

# Site-specific policy script to load. Zeek will look for this in
# $PREFIX/share/zeek/site. A default local.zeek comes preinstalled
# and can be customized as desired.
SitePolicyScripts = local.zeek

# Location of the log directory where log files will be archived each rotation
# interval.
LogDir = /ZeekLogs

# Location of the spool directory where files and data that are currently being
# written are stored.
SpoolDir = /usr/local/zeek/spool

# Location of the directory in which the databases for Broker datastore backed
# Zeek tables are stored.
BrokerDBDir = /usr/local/zeek/spool/brokerstore

# Location of other configuration files that can be used to customize
# ZeekControl operation (e.g. local networks, nodes).
CfgDir = /usr/local/zeek/etc

```

OS: Fedora Linux 35 (5.19.12-100.fc35.aarch64)  
RPi 4B  
No disk space issues

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [October 17, 2022, 9:04am UTC](https://community.zeek.org/t/zeek-keeps-crashing-due-to-some-weird-error-message/6754/2 "2022-10-17T09:04:24Z")

</div>

Hey @espressobeanies , welcome!

> _error in /usr/local/zeek/spool/installed-scripts-do-not-touch/auto/standalone-layout.zeek, line 6: Failed to listen on INADDR\_ANY:47760 (Broker::listen(Broker::default\_listen\_address, Broker::default\_port, Broker::default\_listen\_retry))_  
> _fatal error: errors occurred while initializing_

Any chance you’re running into the following issue caused by a suboptimal default port choice in zeekctl?

> <https://github.com/zeek/zeekctl/pull/41>
>
> WARNING: This breaks users that have setup strict firewalls between Zeek
> … nodes, but at the same time fixes spurious worker failures.
> 
> On Linux, port 47760 and the following ports selected by zeekctl fall square
> into the ephemeral port range. This has resulted in multiple users reporting
> Zeek workers spuriously failing to start with messages as follows:
> 
> error in /usr/local/zeek-5.0.0/share/zeek/base/frameworks/cluster/./setup-connections.zeek, lines 94-96: Failed to listen on INADDR\_ANY:47764 (Broker::listen(Broker::default\_listen\_address, Cluster::self$p, Broker::default\_listen\_retry))
> fatal error: errors occurred while initializing
> 
> This can happen when another process on the system are using a port that
> a Zeek process is supposed to listen on. They are free to do so, these
> ports are in the default ephemeral port range. Even the outgoing connection
> from the same or another worker to the manager or logger has been
> observed to cause this.
> 
> FreeBSD users have not seen this previously, as its ephemeral port range
> is above 47760 (49152), but on Linux it starts as low as 32768.

Try setting ZeekPort explicitly to 27760 in zeekctl.cfg and see if this alleviates the errors happening during initialization.

There is a [thread on Slack](https://zeekorg.slack.com/archives/CSZBXF6TH/p1661816428582559) with a few more debugging instructions in case the above doesn’t solve the issue for you.

Hope this helps,  
Arne

---

<div class="post-metadata">

**Author:** ![espressobeanies](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@espressobeanies](https://community.zeek.org/u/espressobeanies)\
**Post date:** [October 18, 2022, 3:56am UTC](https://community.zeek.org/t/zeek-keeps-crashing-due-to-some-weird-error-message/6754/3 "2022-10-18T03:56:04Z")

</div>

Oh wow! That definitely did it! Seems pretty trivial! Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [April 8, 2026, 6:48pm UTC](https://community.zeek.org/t/zeek-keeps-crashing-due-to-some-weird-error-message/6754/4 "2026-04-08T18:48:32Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.