Re: Cluster configuration zeekctl status hangs

--===============1552641854==
Content-Type: multipart/alternative; boundary="000000000000f20f170598cde5a7"

--000000000000f20f170598cde5a7
Content-Type: text/plain; charset="UTF-8"

On Tue, Dec 3, 2019 at 9:28 AM Scot Harris <[email protected]> wrote:

>
>
>
> The problem is that when I run zeekctl status that request hangs:
>
>
>
>
>
>
>
> [zeek@heimdallr etc]$ zeekctl status
>
>
>
> Warning: ZeekControl plugin uses legacy BroControl API. Use
>
> 'import ZeekControl.plugin' instead of 'import BroControl.plugin'
>
>
>
> Getting process status ...
>
> Getting peer status ...
>
>
>
> Only way to resolve this is to kill process 8593.
>
>
>
> Any ideas on why this is hanging?
>

Odd that it's even doing that.. did you change this option in zeekctl.cfg?

# Show all output of the zeekctl status command.  If set to 1, then all
output
# is shown.  If set to 0, then zeekctl status will not collect or show the
peer
# information (and the command will run faster).
StatusCmdShowAll = 0

The default is to skip the "peer status" stuff, which causes zeekctl to
connect to each worker on the broker port.  You may have firewall rules or
something preventing this from working.  Does the zeekctl netstats command
also hang?



>
>
> Secondary problem with a work around available:
>
>
>
> Also have to follow the following steps for the cluster to work.
>
>
>
> 1.       zeekctl install
>
> 2.       setcap cap_net_raw=eip /opt/zeek/bin/zeek    (on the remote peer)
>
> 3.       zeekctl start
>
>
>
> Attempts to use zeekctl deploy does not work as the setcap command needs
> to be run on the remote peer after the install is completed.
>

This should do what you want: https://github.com/PingTrip/broctl-setcap


-- 
Justin

--000000000000f20f170598cde5a7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Tue, Dec 3, 2019 at 9:28 AM Scot Harri=
s &lt;<a href=3D"mailto:[email protected]">[email protected]</a=
>&gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote class=3D"gmail=
_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204=
,204);padding-left:1ex">





<div lang=3D"EN-US">
<div class=3D"gmail-m_-7016327957590441709WordSection1">
<p class=3D"MsoNormal"><br></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">The problem is that when I run zeekctl status that r=
equest hangs:<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">[zeek@heimdallr etc]$ zeekctl status<u></u><u></u></=
p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Warning: ZeekControl plugin uses legacy BroControl A=
PI. Use<u></u><u></u></p>
<p class=3D"MsoNormal">&#39;import ZeekControl.plugin&#39; instead of &#39;=
import BroControl.plugin&#39;<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Getting process status ...<u></u><u></u></p>
<p class=3D"MsoNormal">Getting peer status ...</p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Only way to resolve this is to kill process 8593.<u>=
</u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Any ideas on why this is hanging?</p></div></div></b=
lockquote><div><br></div><div>Odd that it&#39;s even doing that.. did you c=
hange this option in zeekctl.cfg?</div><div><br></div><div># Show all outpu=
t of the zeekctl status command.=C2=A0 If set to 1, then all output<br># is=
 shown.=C2=A0 If set to 0, then zeekctl status will not collect or show the=
 peer<br># information (and the command will run faster).<br>StatusCmdShowA=
ll =3D 0<br></div><div><br></div><div>The default is to skip the &quot;peer=
 status&quot; stuff, which causes zeekctl to connect to each worker on the =
broker port.=C2=A0 You may have firewall rules or something preventing this=
 from working.=C2=A0 Does the zeekctl netstats command also hang?</div><div=
>=C2=A0</div><div>=C2=A0=C2=A0</div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex"><div lang=3D"EN-US"><div class=3D"gmail-m_-7016327957590441709Wo=
rdSection1"><p class=3D"MsoNormal"><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Secondary problem with a work around available:<u></=
u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Also have to follow the following steps for the clus=
ter to work.<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"gmail-m_-7016327957590441709MsoListParagraph"><u></u><span>1.<s=
pan style=3D"font:7pt &quot;Times New Roman&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0
</span></span><u></u>zeekctl install<u></u><u></u></p>
<p class=3D"gmail-m_-7016327957590441709MsoListParagraph"><u></u><span>2.<s=
pan style=3D"font:7pt &quot;Times New Roman&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0
</span></span><u></u>setcap cap_net_raw=3Deip /opt/zeek/bin/zeek=C2=A0=C2=
=A0=C2=A0 (on the remote peer)<u></u><u></u></p>
<p class=3D"gmail-m_-7016327957590441709MsoListParagraph"><u></u><span>3.<s=
pan style=3D"font:7pt &quot;Times New Roman&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0
</span></span><u></u>zeekctl start<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Attempts to use zeekctl deploy does not work as the =
setcap command needs to be run on the remote peer after the install is comp=
leted.</p></div></div></blockquote><div><br></div><div>This should do what =
you want:=C2=A0<a href=3D"https://github.com/PingTrip/broctl-setcap">https:=
//github.com/PingTrip/broctl-setcap</a>=C2=A0</div></div><br clear=3D"all">=
<div><br></div>-- <br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=
=3D"ltr">Justin</div></div></div>

--000000000000f20f170598cde5a7--

--===============1552641854==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1552641854==--