Re: Bro scripts to write logs to Kafka fails
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAM1mTCom12pP02vbfDfymHWeHU4_m6dChA49dtpZX5K0SQ=Qrw@mail.gmail.com> |
Did you install it manually or with bro-pkg? Also, is this master or a specific release? - Jon Zeolla [email protected] On Tue, Mar 19, 2019 at 12:25 PM Patrick Kelley < [email protected]> wrote: > Had some issues with this last week when building our ARM/ICS/IOT sensor. > > Let me see if I can run down some notes. > > On Tue, Mar 19, 2019 at 11:57 AM Arda Savran <[email protected]> > wrote: > >> Hello folks: >> >> I just installed zeek from source on a CentOS7.5 platform. Everything >> works fine. I can confirm that the logs are getting populated with http, >> dns etc. data. >> >> I am trying to write the data to a remote Kafka topic. I believe I >> compiled everything correctly based on the following link: *https://packages.zeek.org/packages/view/7388aa77-4fb7-11e8-88be-0a645a3f3086 >> <https://packages.zeek.org/packages/view/7388aa77-4fb7-11e8-88be-0a645a3f3086>* >> >> And I am getting the expected return when I execute: >> >> * $ bro -N Apache::Kafka* >> * Apache::Kafka - Writes logs to Kafka (dynamic, version 0.3)* >> >> Next, I edited /usr/local/bro/share/bro/site/local.bro and appended the >> following: >> >> *@load packages/metron-bro-plugin-kafka/Apache/Kafka redef >> Kafka::logs_to_send = set(HTTP::LOG, DNS::LOG); redef Kafka::kafka_conf = >> table( ["metadata.broker.list"] = "XX.XX.XX.XX:9092" );* >> >> Unfortunately, this part doesn't work: >> >> *[root@localhost scripts]# broctl check* >> *Warning: broctl config has changed (run the broctl "deploy" command)* >> *bro scripts failed.* >> *fatal error in /usr/local/bro/share/bro/site/local.bro, line 7: can't >> find packages/metron-bro-plugin-kafka/Apache/Kafka* >> >> Has this happened to anyone before? Is there a fix for this? >> >> Thanks, >> >> >> _______________________________________________ >> Zeek mailing list >> [email protected] >> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > > > > -- > > *Patrick Kelley, CISSP, C|EH, ITIL* > *CTO* > [email protected] > (o) 770-224-6482 > > *The limit to which you have accepted being comfortable is the limit to > which you have grown. Accept new challenges as an opportunity to enrich > yourself and not as a point of potential failure.* > > > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek