Noticing "SumStat key request for the.." in reporter.log Zeek 3.0

fatema bannatwala <[email protected]> Fri, 6 Dec 2019 17:00:16 -0500
Newsgroups gmane.comp.security.detection.bro
Message-ID <CACX0rUQR53yOyrmo54zT_H2QNaqEXuJugny6TdthEt6LhYPwvA@mail.gmail.com>
--===============1464398398==
Content-Type: multipart/alternative; boundary="000000000000b6e1780599102cf3"

--000000000000b6e1780599102cf3
Content-Type: text/plain; charset="UTF-8"

Hi Everyone,

I upgraded our external zeek cluster right before ThanksGiving to zeek 3.0,
and have started noticing a fair amount of following warnings in
reporter.log file:

"SumStat key request for the 7PJNSqZOUs8 SumStat uid took longer than 1
minute and was automatically cancelled."

Also, interesting thing is that after the upgrade, generation of
software.log file has become pretty sporadic (no software.log file for last
one week)..

Anyone else noticing this behavior? Any thoughts? Something needs to get
back ported for software.log to work correctly again in zeek 3.0?

Thanks!
Fatema

--000000000000b6e1780599102cf3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Everyone,<br><div><br></div><div>I upgraded our externa=
l zeek cluster right before ThanksGiving to zeek 3.0, and have started noti=
cing a fair amount of following warnings in reporter.log file:</div><div><b=
r></div><div>&quot;SumStat key request for the 7PJNSqZOUs8 SumStat uid took=
 longer than 1 minute and was automatically cancelled.&quot;<br></div><div>=
<br></div><div>Also, interesting thing is that after the upgrade, generatio=
n of software.log file has become pretty sporadic (no software.log file for=
 last one week)..</div><div><br></div><div>Anyone else noticing this behavi=
or? Any thoughts? Something needs to get back ported for software.log to wo=
rk correctly again in zeek 3.0?</div><div><br></div><div>Thanks!</div><div>=
Fatema</div><div><br></div></div>

--000000000000b6e1780599102cf3--

--===============1464398398==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1464398398==--