Noticing "SumStat key request for the.." in reporter.log Zeek 3.0
fatema bannatwala <[email protected]> Fri, 6 Dec 2019 17:00:16 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CACX0rUQR53yOyrmo54zT_H2QNaqEXuJugny6TdthEt6LhYPwvA@mail.gmail.com> |
--===============1464398398== Content-Type: multipart/alternative; boundary="000000000000b6e1780599102cf3" --000000000000b6e1780599102cf3 Content-Type: text/plain; charset="UTF-8" Hi Everyone, I upgraded our external zeek cluster right before ThanksGiving to zeek 3.0, and have started noticing a fair amount of following warnings in reporter.log file: "SumStat key request for the 7PJNSqZOUs8 SumStat uid took longer than 1 minute and was automatically cancelled." Also, interesting thing is that after the upgrade, generation of software.log file has become pretty sporadic (no software.log file for last one week).. Anyone else noticing this behavior? Any thoughts? Something needs to get back ported for software.log to work correctly again in zeek 3.0? Thanks! Fatema --000000000000b6e1780599102cf3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi Everyone,<br><div><br></div><div>I upgraded our externa= l zeek cluster right before ThanksGiving to zeek 3.0, and have started noti= cing a fair amount of following warnings in reporter.log file:</div><div><b= r></div><div>"SumStat key request for the 7PJNSqZOUs8 SumStat uid took= longer than 1 minute and was automatically cancelled."<br></div><div>= <br></div><div>Also, interesting thing is that after the upgrade, generatio= n of software.log file has become pretty sporadic (no software.log file for= last one week)..</div><div><br></div><div>Anyone else noticing this behavi= or? Any thoughts? Something needs to get back ported for software.log to wo= rk correctly again in zeek 3.0?</div><div><br></div><div>Thanks!</div><div>= Fatema</div><div><br></div></div> --000000000000b6e1780599102cf3-- --===============1464398398== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1464398398==--