Re: Noticing "SumStat key request for the.." in reporter.log Zeek 3.0

--===============0914873110==
Content-Type: multipart/alternative; boundary="00000000000033ab1a0599264f30"

--00000000000033ab1a0599264f30
Content-Type: text/plain; charset="UTF-8"

Hi Jon,

Thanks for the insights.
I don't have the misc/scan enabled in local.zeek, actually using Justin's
simple scan detection script.

Also, checked the local scripts that are currently enabled in local.zeek
and found two scripts - detect-ms15-034.bro and
http-basic-auth-bruteforce.bro that use SumStat framework. I have disabled
them to see if the SumStat warnings are reduced in the reporter.log.

Thanks!
Fatema

On Fri, Dec 6, 2019 at 8:26 PM Jon Siwek <[email protected]> wrote:

> On Fri, Dec 6, 2019 at 2:06 PM fatema bannatwala
> <[email protected]> wrote:
>
> > I upgraded our external zeek cluster right before ThanksGiving to zeek
> 3.0, and have started noticing a fair amount of following warnings in
> reporter.log file:
> >
> > "SumStat key request for the 7PJNSqZOUs8 SumStat uid took longer than 1
> minute and was automatically cancelled."
>
> Did you happen to copy over a previous local.bro that still has "@load
> misc/scan" in it?  The new local.zeek has that commented out due to it
> being frequent cause of performance issues.
>
> > Also, interesting thing is that after the upgrade, generation of
> software.log file has become pretty sporadic (no software.log file for last
> one week)..
>
> One reason for that may be if you don't have any proxy nodes in your
> cluster config (or they aren't reachable for some reason).
>
> - Jon
>

--00000000000033ab1a0599264f30
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Jon,<div><br></div><div>Thanks for the insights.</div><=
div>I don&#39;t have the misc/scan enabled in local.zeek, actually using Ju=
stin&#39;s simple scan detection script.</div><div><br></div><div>Also, che=
cked the local scripts that are currently enabled in local.zeek and found t=
wo scripts=C2=A0- detect-ms15-034.bro and http-basic-auth-bruteforce.bro th=
at use SumStat framework. I have disabled them to see if the SumStat warnin=
gs are reduced in the reporter.log.</div><div><br></div><div>Thanks!</div><=
div>Fatema</div>











</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">=
On Fri, Dec 6, 2019 at 8:26 PM Jon Siwek &lt;<a href=3D"mailto:jsiwek@corel=
ight.com">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D=
"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(2=
04,204,204);padding-left:1ex">On Fri, Dec 6, 2019 at 2:06 PM fatema bannatw=
ala<br>
&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">fatema=
[email protected]</a>&gt; wrote:<br>
<br>
&gt; I upgraded our external zeek cluster right before ThanksGiving to zeek=
 3.0, and have started noticing a fair amount of following warnings in repo=
rter.log file:<br>
&gt;<br>
&gt; &quot;SumStat key request for the 7PJNSqZOUs8 SumStat uid took longer =
than 1 minute and was automatically cancelled.&quot;<br>
<br>
Did you happen to copy over a previous local.bro that still has &quot;@load=
<br>
misc/scan&quot; in it?=C2=A0 The new local.zeek has that commented out due =
to it<br>
being frequent cause of performance issues.<br>
<br>
&gt; Also, interesting thing is that after the upgrade, generation of softw=
are.log file has become pretty sporadic (no software.log file for last one =
week)..<br>
<br>
One reason for that may be if you don&#39;t have any proxy nodes in your<br=
>
cluster config (or they aren&#39;t reachable for some reason).<br>
<br>
- Jon<br>
</blockquote></div>

--00000000000033ab1a0599264f30--

--===============0914873110==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0914873110==--