Re: capstats
Justin Azoff <[email protected]> Wed, 4 Dec 2019 20:25:49 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCujo51ZnSB-xXg+vccqyUgxvU3Xnby9CAaGAQbbufq9yDQ@mail.gmail.com> |
--===============1203095230== Content-Type: multipart/alternative; boundary="0000000000004dfae70598ead1dd" --0000000000004dfae70598ead1dd Content-Type: text/plain; charset="UTF-8" If you're using that setcap plugin you also need to run setcap on ..../ bin/capstats On Wed, Dec 4, 2019 at 5:34 PM Scot Harris <[email protected]> wrote: > Noticed this while running zeekctl > > > > Ran the capstats command with this result: > > > > [ZeekControl] > capstats > > Interface kpps mbps (10s average) > > ---------------------------------------- > > worker-1-1: capstats failed (error: eno1: You don't have permission to > capture on that device (socket: Operation not permitted)) > > worker-3-1: capstats failed (error: eno1: You don't have permission to > capture on that device (socket: Operation not permitted)) > > > > > > > > Run status: > > > > > > [ZeekControl] > status > > Name Type Host Status Pid Started > > logger logger 10.1.1.15 running 5656 03 Dec 11:24:51 > > manager manager 10.1.1.15 running 5783 03 Dec 11:24:53 > > proxy-1 proxy 10.1.1.15 running 5834 03 Dec 11:24:54 > > worker-1-1 worker 10.1.1.15 running 6026 03 Dec 11:24:55 > > worker-1-2 worker 10.1.1.15 running 6027 03 Dec 11:24:55 > > worker-2-1 worker 10.1.1.15 running 6031 03 Dec 11:24:55 > > worker-2-2 worker 10.1.1.15 running 6030 03 Dec 11:24:55 > > worker-3-1 worker 10.1.7.186 running 9937 04 Dec 17:16:56 > > worker-3-2 worker 10.1.7.186 running 9995 04 Dec 17:17:23 > > worker-4-1 worker 10.1.7.186 running 10040 04 Dec 17:17:29 > > worker-4-2 worker 10.1.7.186 running 10085 04 Dec 17:17:32 > > > > > > Seems like the capstats command is incorrect. > > > > They system is collecting data. > > > > The workers that are listed are the first ones on each device. > > > > This is zeek 3.0. > > > > > __________________________________________ > *Scot Harris* > Network Engineer > City of Hollywood > Information Technology > > P.O. Box 229045 > Hollywood, FL 33022-9045 > Office: 954-921-3304 > E-mail: [email protected] > [image: www.hollywoodfl.org] > Notice: Florida has a broad public records law. All correspondence sent to > the City of Hollywood via e-mail may be subject to disclosure as a matter > of public record. > __________________________________________ > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek -- Justin --0000000000004dfae70598ead1dd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">If you're using that setcap plugin you also need to ru= n setcap on ..../<span style=3D"background-color:initial;font-family:SFMono= -Regular,Consolas,"Liberation Mono",Menlo,monospace;color:rgb(36,= 41,46);font-size:13.6px">bin/capstats</span></div><br><div class=3D"gmail_q= uote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Dec 4, 2019 at 5:34 PM = Scot Harris <<a href=3D"mailto:[email protected]">SHARRIS@hollywoo= dfl.org</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"= margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef= t:1ex"> <div lang=3D"EN-US"> <div class=3D"gmail-m_-8350428139539558746WordSection1"> <p class=3D"MsoNormal">Noticed this while running zeekctl<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">Ran the capstats command with this result:<u></u><u>= </u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">[ZeekControl] > capstats<u></u><u></u></p> <p class=3D"MsoNormal">Interface=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 kpps=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 mbp= s=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (10s average)<u></u><u></u></p> <p class=3D"MsoNormal">----------------------------------------<u></u><u></= u></p> <p class=3D"MsoNormal">worker-1-1: capstats failed (error: eno1: You don= 9;t have permission to capture on that device (socket: Operation not permit= ted))<u></u><u></u></p> <p class=3D"MsoNormal">worker-3-1: capstats failed (error: eno1: You don= 9;t have permission to capture on that device (socket: Operation not permit= ted))<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">Run status:<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">[ZeekControl] > status<u></u><u></u></p> <p class=3D"MsoNormal">Name=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= Type=C2=A0=C2=A0=C2=A0 Host=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0 Status=C2=A0=C2=A0=C2=A0 Pid=C2=A0=C2=A0=C2=A0 = Started<u></u><u></u></p> <p class=3D"MsoNormal">logger=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 logger=C2= =A0 10.1.1.15=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0= 5656=C2=A0=C2=A0 03 Dec 11:24:51<u></u><u></u></p> <p class=3D"MsoNormal">manager=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 manager 10.1.1= .15=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 5783=C2= =A0=C2=A0 03 Dec 11:24:53<u></u><u></u></p> <p class=3D"MsoNormal">proxy-1=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 proxy=C2=A0=C2= =A0 10.1.1.15=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0= 5834=C2=A0=C2=A0 03 Dec 11:24:54<u></u><u></u></p> <p class=3D"MsoNormal">worker-1-1=C2=A0=C2=A0 worker=C2=A0 10.1.1.15=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 6026=C2=A0=C2=A0 0= 3 Dec 11:24:55<u></u><u></u></p> <p class=3D"MsoNormal">worker-1-2=C2=A0=C2=A0 worker=C2=A0 10.1.1.15=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 6027=C2=A0=C2=A0 0= 3 Dec 11:24:55<u></u><u></u></p> <p class=3D"MsoNormal">worker-2-1=C2=A0=C2=A0 worker=C2=A0 10.1.1.15=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 6031=C2=A0=C2=A0 0= 3 Dec 11:24:55<u></u><u></u></p> <p class=3D"MsoNormal">worker-2-2=C2=A0=C2=A0 worker=C2=A0 10.1.1.15=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 6030=C2=A0=C2=A0 0= 3 Dec 11:24:55<u></u><u></u></p> <p class=3D"MsoNormal">worker-3-1=C2=A0=C2=A0 worker=C2=A0 10.1.7.186=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 9937=C2=A0=C2=A0 04 Dec = 17:16:56<u></u><u></u></p> <p class=3D"MsoNormal">worker-3-2=C2=A0=C2=A0 worker=C2=A0 10.1.7.186=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 9995=C2=A0=C2=A0 04 Dec = 17:17:23<u></u><u></u></p> <p class=3D"MsoNormal">worker-4-1=C2=A0=C2=A0 worker=C2=A0 10.1.7.186=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 10040=C2=A0 04 Dec 17:17= :29<u></u><u></u></p> <p class=3D"MsoNormal">worker-4-2=C2=A0=C2=A0 worker=C2=A0 10.1.7.186=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 running=C2=A0=C2=A0 10085=C2=A0 04 Dec 17:17= :32<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">Seems like the capstats command is incorrect.<u></u>= <u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">They system is collecting data.<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">The workers that are listed are the first ones on ea= ch device.<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal">This is zeek 3.0.<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div style=3D"font-size:9pt">__________________________________________<br> <i><b>Scot Harris</b></i><br> Network Engineer<br> City of Hollywood<br> Information Technology<br> <br> P.O. Box 229045<br> Hollywood, FL 33022-9045<br> Office: 954-921-3304<br> E-mail: <a href=3D"mailto:[email protected]" target=3D"_blank">SHARRI= [email protected]</a><br> <div><img alt=3D"www.hollywoodfl.org" src=3D"http://apps.hollywoodfl.org/im= ages/coh_logo_color.png"></div> Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record.<br> __________________________________________</div> </div> _______________________________________________<br> Zeek mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n= oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi= nfo/zeek</a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div= dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Justin</div></div> --0000000000004dfae70598ead1dd-- --===============1203095230== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1203095230==--