Zeek crashed
Keith M <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <DM5PR03MB324308AD2D24451BEA5BF820C4D70@DM5PR03MB3243.namprd03.prod.outlook.com> |
I'm new to Zeek. I noticed my Zeek is crashing every few days. I have the below bt Core was generated by `/opt/bro/bin/bro -U .status -p broctl -p broctl-live -p local -p logger local.b'. Program terminated with signal 11, Segmentation fault. #0 0x0000000000894795 in logging::Manager::CheckFilterWriterConflict(logging::Manager::WriterInfo const*, logging::Manager::Filter const*) () (gdb) bt #0 0x0000000000894795 in logging::Manager::CheckFilterWriterConflict(logging::Manager::WriterInfo const*, logging::Manager::Filter const*) () #1 0x000000000089999f in logging::Manager::Write(EnumVal*, RecordVal*) () #2 0x00000000005d5436 in BifFunc::Log::bro___write(Frame*, ValPList*) () #3 0x00000000005e502f in BuiltinFunc::Call(ValPList*, Frame*) const () #4 0x00000000005c7f46 in CallExpr::Eval(Frame*) const () #5 0x0000000000639351 in StmtList::Exec(Frame*, stmt_flow_type&) const () #6 0x00000000005f1294 in BroFunc::Call(ValPList*, Frame*) const () #7 0x00000000005c7f46 in CallExpr::Eval(Frame*) const () #8 0x000000000063aee4 in ExprStmt::Exec(Frame*, stmt_flow_type&) const () #9 0x0000000000639351 in StmtList::Exec(Frame*, stmt_flow_type&) const () #10 0x00000000005f1294 in BroFunc::Call(ValPList*, Frame*) const () #11 0x00000000005ade1a in EventHandler::Call(ValPList*, bool) () #12 0x00000000005ad106 in EventMgr::Drain() () #13 0x0000000000601b49 in net_run() () #14 0x000000000055e4a3 in main () I'm not sure what do make out of it. Everything was stable until two things changed. I went from stand alone to clustermode on the one server as I brought in another interface for a different set of networks. So now there are two network interfaces receiving packets in a cluster on one physical server. Any troubleshooting steps appreciated. thanks _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek