Zeek crashed

Keith M <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <DM5PR03MB324308AD2D24451BEA5BF820C4D70@DM5PR03MB3243.namprd03.prod.outlook.com>
I'm new to Zeek. I noticed my Zeek is crashing every few days. I have the below bt

Core was generated by `/opt/bro/bin/bro -U .status -p broctl -p broctl-live -p local -p logger local.b'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000894795 in logging::Manager::CheckFilterWriterConflict(logging::Manager::WriterInfo const*, logging::Manager::Filter const*) ()
(gdb) bt
#0  0x0000000000894795 in logging::Manager::CheckFilterWriterConflict(logging::Manager::WriterInfo const*, logging::Manager::Filter const*) ()
#1  0x000000000089999f in logging::Manager::Write(EnumVal*, RecordVal*) ()
#2  0x00000000005d5436 in BifFunc::Log::bro___write(Frame*, ValPList*) ()
#3  0x00000000005e502f in BuiltinFunc::Call(ValPList*, Frame*) const ()
#4  0x00000000005c7f46 in CallExpr::Eval(Frame*) const ()
#5  0x0000000000639351 in StmtList::Exec(Frame*, stmt_flow_type&) const ()
#6  0x00000000005f1294 in BroFunc::Call(ValPList*, Frame*) const ()
#7  0x00000000005c7f46 in CallExpr::Eval(Frame*) const ()
#8  0x000000000063aee4 in ExprStmt::Exec(Frame*, stmt_flow_type&) const ()
#9  0x0000000000639351 in StmtList::Exec(Frame*, stmt_flow_type&) const ()
#10 0x00000000005f1294 in BroFunc::Call(ValPList*, Frame*) const ()
#11 0x00000000005ade1a in EventHandler::Call(ValPList*, bool) ()
#12 0x00000000005ad106 in EventMgr::Drain() ()
#13 0x0000000000601b49 in net_run() ()
#14 0x000000000055e4a3 in main ()

I'm not sure what do make out of it. Everything was stable until two things changed. I went from stand alone to clustermode on the one server as I brought in another interface for a different set of networks. So now there are two network interfaces receiving packets in a cluster on one physical server. Any troubleshooting steps appreciated.

thanks

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.