03-04 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path reporter #open 2018-08-03-03-28-55 #fields ts level message location #types time enum string string 1533238134.691810 Reporter::INFO Failed to open GeoIP City database: /usr/local/share/GeoIP/GeoIPCity.dat (empty) 1533238134.691810 Reporter::ERROR Failed fall back to GeoIP Country database: /usr/local/share/GeoIP/GeoIP.dat (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30 1533238134.691810 Reporter::INFO Failed to open GeoIP Cityv6 database: /usr/local/share/GeoIP/GeoIPCityv6.dat (empty) 1533238134.691810 Reporter::INFO Failed to open GeoIPv6 Country database: /usr/local/share/GeoIP/GeoIPv6.dat (empty) 1533238134.691810 Reporter::ERROR Can't open GeoIPv6 City/Country database (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30 04-05 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path reporter #open 2018-08-03-04-00-03 #fields ts level message location #types time enum string string 1533240002.728989 Reporter::INFO Failed to open GeoIP City database: /usr/local/share/GeoIP/GeoIPCity.dat (empty) 1533240002.728989 Reporter::ERROR Failed fall back to GeoIP Country database: /usr/local/share/GeoIP/GeoIP.dat (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30 1533240002.728989 Reporter::INFO Failed to open GeoIP Cityv6 database: /usr/local/share/GeoIP/GeoIPCityv6.dat (empty) 1533240002.728989 Reporter::INFO Failed to open GeoIPv6 Country database: /usr/local/share/GeoIP/GeoIPv6.dat (empty) 1533240002.728989 Reporter::ERROR Can't open GeoIPv6 City/Country database (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30 #close 2018-08-03-05-00-00 08-09 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path reporter #open 2018-08-03-08-43-29 #fields ts level message location #types time enum string string 1533257009.326482 Reporter::INFO Failed to open GeoIP City database: /usr/local/share/GeoIP/GeoIPCity.dat (empty) 1533257009.326482 Reporter::ERROR Failed fall back to GeoIP Country database: /usr/local/share/GeoIP/GeoIP.dat (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30 1533257009.326482 Reporter::INFO Failed to open GeoIP Cityv6 database: /usr/local/share/GeoIP/GeoIPCityv6.dat (empty) 1533257009.326482 Reporter::INFO Failed to open GeoIPv6 Country database: /usr/local/share/GeoIP/GeoIPv6.dat (empty) 1533257009.326482 Reporter::ERROR Can't open GeoIPv6 City/Country database (lookup_location(SSH::lookup_ip)) /usr/local/share/bro/policy/protocols/ssh/geo-data.bro, line 30 12-13 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path reporter #open 2018-08-03-12-40-35 #fields ts level message location #types time enum string string 0.000000 Reporter::WARNING SumStat key request for the yJm51Ija4n2 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the Rgjl3p5j8G6 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 0bBP4XPttp1 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the eV7UIeJ0lii SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 5sywAU43TZ3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the rpzJrsHAuoj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the fuGKtpF5yDh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the wkrlcxdspf4 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the nGiy2Px1Vj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the zX1md8gAVk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the nJ8eAOOtfee SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the URUoIOFOFxh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the LFcjViG44lb SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the nJx9urDeEhc SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the k5BLDhhBxvi SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the mk9hFatxsb SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the ZzqbLFgX9Jj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 13-14 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path reporter #open 2018-08-03-13-00-35 #fields ts level message location #types time enum string string 0.000000 Reporter::WARNING SumStat key request for the MRxrKLnNZl8 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 5MieYUYF0El SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the cD1NAIdOFI7 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the Y7jN1dWVLCc SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the XVm2IUbJ9b8 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the CbxVJLHz0b6 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the Ouk9VETPMu7 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 4eHw1xqUaIk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the huwzjWcmnz SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the GgopcTSUvWk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the N2GyKJTeIU8 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the BkXJmf8hoji SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the bYSydE8KbY7 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the vpnQcCyqICa SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the ZiYNuPKVemc SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the mswraHv9Tqk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the USf4di47F0i SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the TNUjUKCsJm9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the u2KmX2XYipk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the Z6W26Gm0SPa SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the Wo4pCvbP8Y9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the TVk1wA4DI4 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the YU0LLe1btHf SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the D1ZIm6iQ9C3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the vPsgst6ieKj SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the A47jKfSNApl SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the c5qIGRRFUG5 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the nQfW85qFHI4 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the h0INflg0Cb9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 3hhgz39Vk82 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the GXKOoG2oKBe SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the hwuC2P9bN8g SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the PH3pCJG6gOh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the BtUVa3OC1y9 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the MDRDGhqVO2a SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 3Dri8MvN5if SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the tyhuo0d2F3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the K9Y5N7FupKk SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 2H1RD6Szna1 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the XUYJGaDHX5a SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the ZZWpYCM7gi3 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the Rcdu031Ah05 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the LoMUR5Jfs05 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the 4Vq92NaNSoh SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the HlSFXOt2Uze SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the siclIgJZp3f SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the DqKEYVf97fd SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the lTHlJ44cKFe SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the roQd5qhFg6 SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216 0.000000 Reporter::WARNING SumStat key request for the bcElnjIqr5i SumStat uid took longer than 1 minute and was automatically cancelled. /usr/local/share/bro/base/frameworks/sumstats/./cluster.bro, line 216