Re: Cannot determine Bro source directory, use --bro-dist=DIR.
Jeffry Lang <[email protected]> Wed, 27 Nov 2019 10:04:54 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAEzr=8O0bb3-1aAq0AZZ82jWvMGDqnTa8Q-doUud_XuURFW_Sw@mail.gmail.com> |
--===============1039611429== Content-Type: multipart/alternative; boundary="00000000000063e04c0598555293" --00000000000063e04c0598555293 Content-Type: text/plain; charset="UTF-8" I've not attempted to install that plugin but looking at the github for it, https://github.com/apache/metron-bro-plugin-kafka, it has this statement "bro-pkg is the preferred mechanism for installing this plugin, as it will dynamically retrieve, build, test, and load the plugin." That leads me to the zkg config file documentation at https://docs.zeek.org/projects/package-manager/en/stable/zkg.html#zkg-config-file # The directory containing Zeek distribution source code. This is only# needed when installing packages that contain Zeek plugins that are# not pre-built. The legacy name of this option is "bro_dist".zeek_dist = It doesn't sound like the plugin is prebuilt, so zkg is trying to do it. Do you have the source code anywhere on the system? Have you defined that varialbe in the config file to point to that location? Thank you, Jeff Lang --------------------------------------------------- Jeffry Lang IT Security Operations (0284) 1300 Torgersen Hall, Virginia Tech 620 Drillfield Dr. Blacksburg VA 24061 540-231-4117 [email protected] On Wed, Nov 27, 2019 at 9:49 AM Fadel <[email protected]> wrote: > Hello zeek community, > Could anyone please help me solve this issue? > I'm not able to move forward... > > Thanks very much! > > On Tue, Nov 12, 2019, 4:05 PM Fadel <[email protected]> wrote: > >> Hi, I've been trying to install this plugin and it seems to have >> some issues or confusion between bro and zeek for that plugin. >> Anyone encountered this issue? >> Thanks! >> >> >> ~]# zkg install apache/metron-bro-plugin-kafka >> The following packages will be INSTALLED: >> zeek/apache/metron-bro-plugin-kafka (0.3) >> >> Verify the following REQUIRED external dependencies: >> (Ensure their installation on all relevant systems before proceeding): >> from zeek/apache/metron-bro-plugin-kafka (0.3): >> librdkafka ~0.11.5 >> >> Proceed? [Y/n] >> zeek/apache/metron-bro-plugin-kafka asks for LIBRDKAFKA_ROOT (Path to >> librdkafka installation tree) ? [/usr/local/lib] >> Saved answers to config file: /root/.zkg/config >> Running unit tests for "zeek/apache/metron-bro-plugin-kafka" >> error: failed to run tests for zeek/apache/metron-bro-plugin-kafka: >> package build_command failed, see log in >> /root/.zkg/logs/metron-bro-plugin-kafka-build.log >> Proceed to install anyway? [N/y] >> >> ~]# cat /root/.zkg/logs/metron-bro-plugin-kafka-build.log >> === STDERR === >> === STDOUT === >> Cannot determine Bro source directory, use --bro-dist=DIR. >> >> >> _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --00000000000063e04c0598555293 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I've not attempted to install that plugin but looking = at the github for it,=C2=A0<a href=3D"https://github.com/apache/metron-bro-= plugin-kafka">https://github.com/apache/metron-bro-plugin-kafka</a>, it has= this statement "bro-pkg is the preferred mechanism for installing thi= s plugin, as it will dynamically retrieve, build, test, and load the plugin= ."=C2=A0 That leads me to the zkg config file documentation at=C2=A0<a= href=3D"https://docs.zeek.org/projects/package-manager/en/stable/zkg.html#= zkg-config-file">https://docs.zeek.org/projects/package-manager/en/stable/z= kg.html#zkg-config-file</a><div><br></div><div><pre style=3D"box-sizing:bor= der-box;font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation M= ono","Courier New",Courier,monospace;font-size:12px;margin-t= op:0px;margin-bottom:0px;padding:12px;overflow:auto;line-height:1.4;color:r= gb(64,64,64)"><span class=3D"gmail-c1" style=3D"box-sizing:border-box;color= :rgb(64,128,144);font-style:italic"># The directory containing Zeek distrib= ution source code. This is only</span> <span class=3D"gmail-c1" style=3D"box-sizing:border-box;color:rgb(64,128,14= 4);font-style:italic"># needed when installing packages that contain Zeek p= lugins that are</span> <span class=3D"gmail-c1" style=3D"box-sizing:border-box;color:rgb(64,128,14= 4);font-style:italic"># not pre-built. The legacy name of this option is &= quot;bro_dist".</span> <span class=3D"gmail-n" style=3D"box-sizing:border-box">zeek_dist</span> <s= pan class=3D"gmail-o" style=3D"box-sizing:border-box;color:rgb(102,102,102)= ">=3D</span></pre><div><div dir=3D"ltr" class=3D"gmail_signature" data-smar= tmail=3D"gmail_signature"><div dir=3D"ltr"><div>It doesn't sound like t= he plugin is prebuilt, so zkg is trying to do it.=C2=A0 Do you have the sou= rce code anywhere on the system?=C2=A0 Have you defined that varialbe in th= e config file to point to that location?</div><div><br>Thank you,<br><br>Je= ff Lang<br><br>---------------------------------------------------<br><br>J= effry Lang<br>IT Security Operations (0284)<br>1300 Torgersen Hall, Virgini= a Tech<br>620 Drillfield Dr.<br>Blacksburg VA 24061<br>540-<span style=3D"f= ont-size:12.8px">231-4117</span><br><a href=3D"mailto:[email protected]" targ= et=3D"_blank">[email protected]</a></div></div></div></div><br></div></div><b= r><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, = Nov 27, 2019 at 9:49 AM Fadel <<a href=3D"mailto:[email protected]">fad= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote" s= tyle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pad= ding-left:1ex"><div dir=3D"auto"><div>Hello zeek community,</div><div dir= =3D"auto">Could anyone please help me solve=C2=A0this issue?</div><div dir= =3D"auto">I'm not able to move forward...</div><div dir=3D"auto"><br></= div><div dir=3D"auto">Thanks very much!<br><br><div class=3D"gmail_quote" d= ir=3D"auto"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Nov 12, 2019, 4:0= 5 PM Fadel <<a href=3D"mailto:[email protected]" target=3D"_blank">fade= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote" st= yle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padd= ing-left:1ex"><div dir=3D"auto"><div dir=3D"auto">Hi, I've been trying = to install this plugin and it seems to have some=C2=A0issues or confusion b= etween bro and zeek for that plugin.</div><div dir=3D"auto">Anyone encounte= red this issue?</div><div dir=3D"auto">Thanks!</div><div dir=3D"auto"><br><= /div><div dir=3D"auto"><br></div><div dir=3D"auto">~]# zkg install apache/m= etron-bro-plugin-kafka</div><div dir=3D"auto">The following packages will b= e INSTALLED:</div><div dir=3D"auto">=C2=A0zeek/apache/metron-bro-plugin-kaf= ka (0.3)</div><div dir=3D"auto"><br></div><div dir=3D"auto">Verify the foll= owing REQUIRED external dependencies:</div><div dir=3D"auto">(Ensure their = installation on all relevant systems before proceeding):</div><div dir=3D"a= uto">=C2=A0from zeek/apache/metron-bro-plugin-kafka (0.3):</div><div dir=3D= "auto">=C2=A0 =C2=A0librdkafka ~0.11.5</div><div dir=3D"auto"><br></div><di= v dir=3D"auto">Proceed? [Y/n]=C2=A0</div><div dir=3D"auto">zeek/apache/metr= on-bro-plugin-kafka asks for LIBRDKAFKA_ROOT (Path to librdkafka installati= on tree) ? [/usr/local/lib]=C2=A0</div><div dir=3D"auto">Saved answers to c= onfig file: /root/.zkg/config</div><div dir=3D"auto">Running unit tests for= "zeek/apache/metron-bro-plugin-kafka"</div><div dir=3D"auto">err= or: failed to run tests for zeek/apache/metron-bro-plugin-kafka: package bu= ild_command failed, see log in /root/.zkg/logs/metron-bro-plugin-kafka-buil= d.log</div><div dir=3D"auto">Proceed to install anyway? [N/y]</div><div dir= =3D"auto"><br></div><div dir=3D"auto"><div dir=3D"auto">~]# cat /root/.zkg/= logs/metron-bro-plugin-kafka-build.log</div><div dir=3D"auto">=3D=3D=3D STD= ERR =3D=3D=3D</div><div dir=3D"auto">=3D=3D=3D STDOUT =3D=3D=3D</div><div d= ir=3D"auto">Cannot determine Bro source directory, use --bro-dist=3DDIR.</d= iv><div dir=3D"auto"><br></div></div><div dir=3D"auto"><br></div></div> </blockquote></div></div></div> _______________________________________________<br> Zeek mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n= oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi= nfo/zeek</a></blockquote></div> --00000000000063e04c0598555293-- --===============1039611429== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1039611429==--