capstats
Scot Harris <[email protected]> Wed, 4 Dec 2019 22:31:22 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <SN6PR0901MB2480474889DFC4D42897DF3FA95D0@SN6PR0901MB2480.namprd09.prod.outlook.com> |
--===============1431383245== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_SN6PR0901MB2480474889DFC4D42897DF3FA95D0SN6PR0901MB2480_" --_000_SN6PR0901MB2480474889DFC4D42897DF3FA95D0SN6PR0901MB2480_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Noticed this while running zeekctl Ran the capstats command with this result: [ZeekControl] > capstats Interface kpps mbps (10s average) ---------------------------------------- worker-1-1: capstats failed (error: eno1: You don't have permission to capt= ure on that device (socket: Operation not permitted)) worker-3-1: capstats failed (error: eno1: You don't have permission to capt= ure on that device (socket: Operation not permitted)) Run status: [ZeekControl] > status Name Type Host Status Pid Started logger logger 10.1.1.15 running 5656 03 Dec 11:24:51 manager manager 10.1.1.15 running 5783 03 Dec 11:24:53 proxy-1 proxy 10.1.1.15 running 5834 03 Dec 11:24:54 worker-1-1 worker 10.1.1.15 running 6026 03 Dec 11:24:55 worker-1-2 worker 10.1.1.15 running 6027 03 Dec 11:24:55 worker-2-1 worker 10.1.1.15 running 6031 03 Dec 11:24:55 worker-2-2 worker 10.1.1.15 running 6030 03 Dec 11:24:55 worker-3-1 worker 10.1.7.186 running 9937 04 Dec 17:16:56 worker-3-2 worker 10.1.7.186 running 9995 04 Dec 17:17:23 worker-4-1 worker 10.1.7.186 running 10040 04 Dec 17:17:29 worker-4-2 worker 10.1.7.186 running 10085 04 Dec 17:17:32 Seems like the capstats command is incorrect. They system is collecting data. The workers that are listed are the first ones on each device. This is zeek 3.0. __________________________________________ Scot Harris Network Engineer City of Hollywood Information Technology P.O. Box 229045 Hollywood, FL 33022-9045 Office: 954-921-3304 E-mail: [email protected] [www.hollywoodfl.org] Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record. __________________________________________ --_000_SN6PR0901MB2480474889DFC4D42897DF3FA95D0SN6PR0901MB2480_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:m=3D"http://schema= s.microsoft.com/office/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html= 40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri",sans-serif;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Noticed this while running zeekctl<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Ran the capstats command with this result:<o:p></o:p= ></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">[ZeekControl] > capstats<o:p></o:p></p> <p class=3D"MsoNormal">Interface &= nbsp; kpps mbps= (10s average)<o:p></o:p></p> <p class=3D"MsoNormal">----------------------------------------<o:p></o:p><= /p> <p class=3D"MsoNormal">worker-1-1: capstats failed (error: eno1: You don't = have permission to capture on that device (socket: Operation not permitted)= )<o:p></o:p></p> <p class=3D"MsoNormal">worker-3-1: capstats failed (error: eno1: You don't = have permission to capture on that device (socket: Operation not permitted)= )<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Run status:<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">[ZeekControl] > status<o:p></o:p></p> <p class=3D"MsoNormal">Name = Type Host  = ; Status Pid St= arted<o:p></o:p></p> <p class=3D"MsoNormal">logger logger&nb= sp; 10.1.1.15 running = 5656 03 Dec 11:24:51<o:p></o:p></p> <p class=3D"MsoNormal">manager manager 10.1.1= .15 running 5783 = ; 03 Dec 11:24:53<o:p></o:p></p> <p class=3D"MsoNormal">proxy-1 proxy &nb= sp; 10.1.1.15 running = 5834 03 Dec 11:24:54<o:p></o:p></p> <p class=3D"MsoNormal">worker-1-1 worker 10.1.1.15 &= nbsp; running 6026 03= Dec 11:24:55<o:p></o:p></p> <p class=3D"MsoNormal">worker-1-2 worker 10.1.1.15 &= nbsp; running 6027 03= Dec 11:24:55<o:p></o:p></p> <p class=3D"MsoNormal">worker-2-1 worker 10.1.1.15 &= nbsp; running 6031 03= Dec 11:24:55<o:p></o:p></p> <p class=3D"MsoNormal">worker-2-2 worker 10.1.1.15 &= nbsp; running 6030 03= Dec 11:24:55<o:p></o:p></p> <p class=3D"MsoNormal">worker-3-1 worker 10.1.7.186 = running 9937 04 Dec = 17:16:56<o:p></o:p></p> <p class=3D"MsoNormal">worker-3-2 worker 10.1.7.186 = running 9995 04 Dec = 17:17:23<o:p></o:p></p> <p class=3D"MsoNormal">worker-4-1 worker 10.1.7.186 = running 10040 04 Dec 17:17= :29<o:p></o:p></p> <p class=3D"MsoNormal">worker-4-2 worker 10.1.7.186 = running 10085 04 Dec 17:17= :32<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Seems like the capstats command is incorrect.<o:p></= o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">They system is collecting data.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">The workers that are listed are the first ones on ea= ch device.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">This is zeek 3.0.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div style=3D"font-size:9pt; font-family: ''Gill Sans MT'',sans-serif;">__= ________________________________________<br> <i><b>Scot Harris</i></b><br> Network Engineer<br> City of Hollywood<br> Information Technology<br> <br> P.O. Box 229045<br> Hollywood, FL 33022-9045<br> Office: 954-921-3304<br> E-mail: [email protected]<br> <div><img alt=3D"www.hollywoodfl.org" src=3D"http://apps.hollywoodfl.org/im= ages/coh_logo_color.png"></div> Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record.<br> __________________________________________</div> </body> </html> --_000_SN6PR0901MB2480474889DFC4D42897DF3FA95D0SN6PR0901MB2480_-- --===============1431383245== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1431383245==--