Cluster configuration zeekctl status hangs
Scot Harris <[email protected]> Tue, 3 Dec 2019 14:24:01 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <SN6PR0901MB24809D99F970926A937F0A7EA9420@SN6PR0901MB2480.namprd09.prod.outlook.com> |
--===============0329482490== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_SN6PR0901MB24809D99F970926A937F0A7EA9420SN6PR0901MB2480_" --_000_SN6PR0901MB24809D99F970926A937F0A7EA9420SN6PR0901MB2480_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Install Zeek 3.0 on Centos 8. Have been working through the setup of zeek using two machines in a cluster= . The cluster appears to be working. I can zeekctl install and zeekctl start the cluster. On the remote machine I see the workers start up. On the local machine the services and workers appear to startup. Remote machine: zeek 25985 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 3 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-3-2 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 25986 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 2 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-3-1 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 25990 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 4 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-4-1 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 25992 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 5 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-4-2 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 26012 25985 9 08:58 ? 00:01:31 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-3-2 loc= al.zee zeekctl base/frameworks/cluster zeekctl/auto zeek 26013 25986 9 08:58 ? 00:01:31 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-3-1 loc= al.zee zeekctl base/frameworks/cluster zeekctl/auto zeek 26016 25992 9 08:58 ? 00:01:31 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-4-2 loc= al.zee zeekctl base/frameworks/cluster zeekctl/auto zeek 26017 25990 9 08:58 ? 00:01:30 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-4-1 loc= al.zee zeekctl base/frameworks/cluster zeekctl/auto Local (manager) machine: zeek 8314 1 0 08:57 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek -1 -U .status -p zeekctl -p zeekctl-live -p loc= al -p logger local.zeek zeekctl base/frameworks/cluster zeekctl/auto zeek 8320 8314 5 08:57 ? 00:00:58 /opt/zeek/bin/zeek -U .stat= us -p zeekctl -p zeekctl-live -p local -p logger local.zeek zeekctl base/fr= ameworks/cluster zeekctl/auto zeek 8361 1 0 08:57 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek -1 -U .status -p zeekctl -p zeekctl-live -p loc= al -p manager local.zeek zeekctl base/frameworks/cluster zeekctl/auto zeek 8367 8361 5 08:57 ? 00:00:59 /opt/zeek/bin/zeek -U .stat= us -p zeekctl -p zeekctl-live -p local -p manager local.zeek zeekctl base/f= rameworks/cluster zeekctl/auto zeek 8406 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek -1 -U .status -p zeekctl -p zeekctl-live -p loc= al -p proxy-1 local.zeek zeekctl base/frameworks/cluster zeekctl/auto zeek 8412 8406 1 08:58 ? 00:00:21 /opt/zeek/bin/zeek -U .stat= us -p zeekctl -p zeekctl-live -p local -p proxy-1 local.zeek zeekctl base/f= rameworks/cluster zeekctl/auto zeek 8471 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 2 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-1-1 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 8474 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 3 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-1-2 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 8477 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 5 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-2-2 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 8479 1 0 08:58 ? 00:00:00 /usr/bin/bash /opt/zeek/sha= re/zeekctl/scripts/run-zeek 4 -i af_packet::eno1 -U .status -p zeekctl -p z= eekctl-live -p local -p worker-2-1 local.zeek zeekctl base/frameworks/clust= er zeekctl/auto zeek 8499 8471 17 08:58 ? 00:03:09 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-1-1 loc= al.zeek zeekctl base/frameworks/cluster zeekctl/auto zeek 8502 8474 21 08:58 ? 00:03:47 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-1-2 loc= al.zeek zeekctl base/frameworks/cluster zeekctl/auto zeek 8503 8477 17 08:58 ? 00:03:09 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-2-2 loc= al.zeek zeekctl base/frameworks/cluster zeekctl/auto zeek 8504 8479 18 08:58 ? 00:03:17 /opt/zeek/bin/zeek -i af_pa= cket::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-2-1 loc= al.zeek zeekctl base/frameworks/cluster zeekctl/auto zeek 8593 3011 6 08:58 pts/0 00:01:04 /usr/bin/python3.6 /opt/zee= k/bin/zeekctl status The problem is that when I run zeekctl status that request hangs: [zeek@heimdallr etc]$ zeekctl status Warning: ZeekControl plugin uses legacy BroControl API. Use 'import ZeekControl.plugin' instead of 'import BroControl.plugin' Getting process status ... Getting peer status ... Only way to resolve this is to kill process 8593. Any ideas on why this is hanging? Secondary problem with a work around available: Also have to follow the following steps for the cluster to work. 1. zeekctl install 2. setcap cap_net_raw=3Deip /opt/zeek/bin/zeek (on the remote peer= ) 3. zeekctl start Attempts to use zeekctl deploy does not work as the setcap command needs to= be run on the remote peer after the install is completed. Running zeek 3.0. __________________________________________ Scot Harris Network Engineer City of Hollywood Information Technology P.O. Box 229045 Hollywood, FL 33022-9045 Office: 954-921-3304 E-mail: [email protected] [www.hollywoodfl.org] Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record. __________________________________________ --_000_SN6PR0901MB24809D99F970926A937F0A7EA9420SN6PR0901MB2480_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:m=3D"http://schema= s.microsoft.com/office/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html= 40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Verdana; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {mso-style-priority:34; margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri",sans-serif;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} /* List Definitions */ @list l0 {mso-list-id:1438789499; mso-list-type:hybrid; mso-list-template-ids:817931246 67698703 67698713 67698715 67698703 676987= 13 67698715 67698703 67698713 67698715;} @list l0:level1 {mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-.25in;} @list l0:level2 {mso-level-number-format:alpha-lower; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-.25in;} @list l0:level3 {mso-level-number-format:roman-lower; mso-level-tab-stop:none; mso-level-number-position:right; text-indent:-9.0pt;} @list l0:level4 {mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-.25in;} @list l0:level5 {mso-level-number-format:alpha-lower; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-.25in;} @list l0:level6 {mso-level-number-format:roman-lower; mso-level-tab-stop:none; mso-level-number-position:right; text-indent:-9.0pt;} @list l0:level7 {mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-.25in;} @list l0:level8 {mso-level-number-format:alpha-lower; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-.25in;} @list l0:level9 {mso-level-number-format:roman-lower; mso-level-tab-stop:none; mso-level-number-position:right; text-indent:-9.0pt;} ol {margin-bottom:0in;} ul {margin-bottom:0in;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Install Zeek 3.0 on Centos 8.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black">Have been working through the setup of = zeek using two machines in a cluster.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black">The cluster appears to be working. = ; <o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black">I can zeekctl install and zeekctl start= the cluster.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black">On the remote machine I see the workers= start up.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black">On the local machine the services and w= orkers appear to startup.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black">Remote machine:<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve= rdana",sans-serif;color:black"><o:p> </o:p></span></p> <p class=3D"MsoNormal">zeek 25985 = 1 0 08:58 ? 00:00:00= /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 3 -i af_packet::eno= 1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-3-2 local.zeek z= eekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 25986 = 1 0 08:58 ? 00:00:00= /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 2 -i af_packet::eno= 1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-3-1 local.zeek z= eekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 25990 = 1 0 08:58 ? 00:00:00= /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 4 -i af_packet::eno= 1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-4-1 local.zeek z= eekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 25992 = 1 0 08:58 ? 00:00:00= /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 5 -i af_packet::eno= 1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-4-2 local.zeek z= eekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 26012 25985 9 08:= 58 ? 00:01:31 /opt/zeek/bin/zeek = -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker= -3-2 local.zee zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal">zeek 26013 25986 9 08:= 58 ? 00:01:31 /opt/zeek/bin/zeek = -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker= -3-1 local.zee zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal">zeek 26016 25992 9 08:= 58 ? 00:01:31 /opt/zeek/bin/zeek = -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker= -4-2 local.zee zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal">zeek 26017 25990 9 08:= 58 ? 00:01:30 /opt/zeek/bin/zeek = -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker= -4-1 local.zee zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Local (manager) machine:<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">zeek 8314 &= nbsp; 1 0 08:57 ? 00:= 00:00 /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek -1 -U .status = -p zeekctl -p zeekctl-live -p local -p logger local.zeek zeekctl base/frame= works/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8320 8314&n= bsp; 5 08:57 ? 00:00:58 /opt/zeek= /bin/zeek -U .status -p zeekctl -p zeekctl-live -p local -p logger local.ze= ek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8361 &= nbsp; 1 0 08:57 ? 00:= 00:00 /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek -1 -U .status = -p zeekctl -p zeekctl-live -p local -p manager local.zeek zeekctl base/fram= eworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8367 8361&n= bsp; 5 08:57 ? 00:00:59 /opt/zeek= /bin/zeek -U .status -p zeekctl -p zeekctl-live -p local -p manager local.z= eek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8406 &= nbsp; 1 0 08:58 ? 00:= 00:00 /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek -1 -U .status = -p zeekctl -p zeekctl-live -p local -p proxy-1 local.zeek zeekctl base/fram= eworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8412 8406&n= bsp; 1 08:58 ? 00:00:21 /opt/zeek= /bin/zeek -U .status -p zeekctl -p zeekctl-live -p local -p proxy-1 local.z= eek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8471 &= nbsp; 1 0 08:58 ? 00:= 00:00 /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 2 -i af_packet= ::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-1-1 local.z= eek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8474 &= nbsp; 1 0 08:58 ? 00:= 00:00 /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 3 -i af_packet= ::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-1-2 local.z= eek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8477 &= nbsp; 1 0 08:58 ? 00:= 00:00 /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 5 -i af_packet= ::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-2-2 local.z= eek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8479 &= nbsp; 1 0 08:58 ? 00:= 00:00 /usr/bin/bash /opt/zeek/share/zeekctl/scripts/run-zeek 4 -i af_packet= ::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p worker-2-1 local.z= eek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p></p> <p class=3D"MsoNormal">zeek 8499 8471 1= 7 08:58 ? 00:03:09 /opt/zeek/bin/= zeek -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p w= orker-1-1 local.zeek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal">zeek 8502 8474 2= 1 08:58 ? 00:03:47 /opt/zeek/bin/= zeek -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p w= orker-1-2 local.zeek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal">zeek 8503 8477 1= 7 08:58 ? 00:03:09 /opt/zeek/bin/= zeek -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p w= orker-2-2 local.zeek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal">zeek 8504 8479 1= 8 08:58 ? 00:03:17 /opt/zeek/bin/= zeek -i af_packet::eno1 -U .status -p zeekctl -p zeekctl-live -p local -p w= orker-2-1 local.zeek zeekctl base/frameworks/cluster zeekctl/auto<o:p></o:p= ></p> <p class=3D"MsoNormal">zeek 8593 3011&n= bsp; 6 08:58 pts/0 00:01:04 /usr/bin/python3.6 /opt/zeek/= bin/zeekctl status<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">The problem is that when I run zeekctl status that r= equest hangs:<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">[zeek@heimdallr etc]$ zeekctl status<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Warning: ZeekControl plugin uses legacy BroControl A= PI. Use<o:p></o:p></p> <p class=3D"MsoNormal">'import ZeekControl.plugin' instead of 'import BroCo= ntrol.plugin'<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Getting process status ...<o:p></o:p></p> <p class=3D"MsoNormal">Getting peer status ...<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Only way to resolve this is to kill process 8593.<o:= p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Any ideas on why this is hanging?<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Secondary problem with a work around available:<o:p>= </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Also have to follow the following steps for the clus= ter to work.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level= 1 lfo1"><![if !supportLists]><span style=3D"mso-list:Ignore">1.<span style= =3D"font:7.0pt "Times New Roman""> &= nbsp; </span></span><![endif]>zeekctl install<o:p></o:p></p> <p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level= 1 lfo1"><![if !supportLists]><span style=3D"mso-list:Ignore">2.<span style= =3D"font:7.0pt "Times New Roman""> &= nbsp; </span></span><![endif]>setcap cap_net_raw=3Deip /opt/zeek/bin/zeek &n= bsp; (on the remote peer)<o:p></o:p></p> <p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level= 1 lfo1"><![if !supportLists]><span style=3D"mso-list:Ignore">3.<span style= =3D"font:7.0pt "Times New Roman""> &= nbsp; </span></span><![endif]>zeekctl start<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Attempts to use zeekctl deploy does not work as the = setcap command needs to be run on the remote peer after the install is comp= leted.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Running zeek 3.0.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div style=3D"font-size:9pt; font-family: ''Gill Sans MT'',sans-serif;">__= ________________________________________<br> <i><b>Scot Harris</i></b><br> Network Engineer<br> City of Hollywood<br> Information Technology<br> <br> P.O. Box 229045<br> Hollywood, FL 33022-9045<br> Office: 954-921-3304<br> E-mail: [email protected]<br> <div><img alt=3D"www.hollywoodfl.org" src=3D"http://apps.hollywoodfl.org/im= ages/coh_logo_color.png"></div> Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record.<br> __________________________________________</div> </body> </html> --_000_SN6PR0901MB24809D99F970926A937F0A7EA9420SN6PR0901MB2480_-- --===============0329482490== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============0329482490==--