Re: Zeek + PF_Ring Issue

--===============1321274981==
Content-Type: multipart/alternative; boundary="000000000000245ff6059a0febb4"

--000000000000245ff6059a0febb4
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Dec 19, 2019 at 7:18 AM Jorge Garc=C3=ADa Rodr=C3=ADguez <
[email protected]> wrote:

> I have ran bro-doctor as you said and certainly I saw interesting things,
> for example:
>
>
> ###################################################################
> # Checking if connections are unevenly distributed across workers #
> ###################################################################
> error: The distribution of connections across workers seems uneven:
> worker-1-5:     462 connections
> worker-1-4:     890 connections
> worker-1-7:     874 connections
> worker-1-6:     4122 connections
> worker-1-1:     432 connections
> worker-1-3:     930 connections
> worker-1-2:     907 connections
> worker-1-9:     451 connections
> worker-1-8:     435 connections
> worker-1-10:    497 connections
>

Interesting indeed.  If you look at your conn log can you tell anything
about all those connections that worker-1-6 is seeing?


> Let me know what do you think about the report.
>
> I have checked about the PF_Ring plugin but it gives me an error, im not
> sure if im following the last update of this plugin.
> https://github.com/ntop/bro-pf_ring
>

you should be able to zkg install bro-pf_ring.. or install it manually with
./configure && make && sudo make install.  are you getting an error when
you do that?


> Also doing a further investigation it seems that the script that is
> overcharguing the cpu is the weird.zeek =C2=BFIs there a way to disable t=
his
> script?
>

Do you say that because you have a lot of entries in the weird log?  that
points to traffic issues that need to be fixed... disabling the weird logs
will just ignore the problem.  What are the top weirds that you are seeing?

    cat /usr/local/zeek/logs/current/weird.log |zeek-cut name|sort|uniq
 -c|sort -rn

What did you see as the result from this check?

# Checking if many recent connections have a SAD or had history


--=20
Justin

--000000000000245ff6059a0febb4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Thu, Dec 19, 2019 at 7:18 AM Jorge Gar=
c=C3=ADa Rodr=C3=ADguez &lt;<a href=3D"mailto:[email protected]">=
[email protected]</a>&gt; wrote:<br></div><div class=3D"gmail_quo=
te"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex">




<div dir=3D"ltr">
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
I have ran bro-doctor as you said and certainly I saw interesting things, f=
or example:</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<br>
</div>
<div id=3D"gmail-m_8854684454924686212Signature">
<div>
<div id=3D"gmail-m_8854684454924686212appendonsend"></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<span>###################################################################<b=
r>
</span>
<div># Checking if connections are unevenly distributed across workers #<br=
>
</div>
<div>###################################################################<br=
>
</div>
<div>error: The distribution of connections across workers seems uneven:<br=
>
</div>
<div>worker-1-5: =C2=A0 =C2=A0 462 connections<br>
</div>
<div>worker-1-4: =C2=A0 =C2=A0 890 connections<br>
</div>
<div>worker-1-7: =C2=A0 =C2=A0 874 connections<br>
</div>
<div><span style=3D"background-color:rgb(255,0,0)">worker-1-6: =C2=A0 =C2=
=A0 4122 connections</span><br>
</div>
<div>worker-1-1: =C2=A0 =C2=A0 432 connections<br>
</div>
<div>worker-1-3: =C2=A0 =C2=A0 930 connections<br>
</div>
<div>worker-1-2: =C2=A0 =C2=A0 907 connections<br>
</div>
<div>worker-1-9: =C2=A0 =C2=A0 451 connections<br>
</div>
<div>worker-1-8: =C2=A0 =C2=A0 435 connections<br>
</div>
<div>worker-1-10: =C2=A0 =C2=A0497 connections</div></div></div></div></div=
></blockquote><div><br></div><div>Interesting indeed.=C2=A0 If you look at =
your conn log can you tell anything about all those connections that worker=
-1-6 is seeing?</div><div><br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex"><div dir=3D"ltr"><div id=3D"gmail-m_8854684454924686212Signature=
"><div><div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-si=
ze:12pt;color:rgb(0,0,0)"><div><br></div><div>
<div><span style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;backgrou=
nd-color:rgb(255,255,255);display:inline">Let me know what do you think abo=
ut the report.</span></div>
<div><br>
</div>
<div>I have checked about the PF_Ring plugin but it gives me an error, im n=
ot sure if im following the last update of this plugin.</div>
<div><a href=3D"https://github.com/ntop/bro-pf_ring" id=3D"gmail-m_88546844=
54924686212LPlnk597229" target=3D"_blank">https://github.com/ntop/bro-pf_ri=
ng</a></div></div></div></div></div></div></blockquote><div><br></div><div>=
you should be able to zkg install bro-pf_ring.. or install it manually with=
 ./configure &amp;&amp; make &amp;&amp; sudo make install.=C2=A0 are you ge=
tting an error when you do that?</div><div>=C2=A0</div><blockquote class=3D=
"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(2=
04,204,204);padding-left:1ex"><div dir=3D"ltr"><div id=3D"gmail-m_885468445=
4924686212Signature"><div><div style=3D"font-family:Calibri,Arial,Helvetica=
,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div>Also doing a further investigation it seems that the script that is ov=
ercharguing the cpu is the weird.zeek =C2=BFIs there a way to disable this =
script?</div></div></div></div></div></blockquote><div><br></div><div>Do yo=
u say that because you have a lot of entries in the weird log?=C2=A0 that p=
oints to traffic issues that need to be fixed... disabling the weird logs w=
ill just ignore the problem.=C2=A0 What are the top weirds that you are see=
ing?</div><div><br></div><div>=C2=A0 =C2=A0=C2=A0cat /usr/local/zeek/logs/c=
urrent/weird.log |zeek-cut name|sort|uniq =C2=A0-c|sort -rn</div><div><br><=
/div><div>What did you see as the result from this check?</div><div><br></d=
iv><div># Checking if many recent connections have a SAD or had history</di=
v><div><br></div><div>=C2=A0<br></div></div>-- <br><div dir=3D"ltr" class=
=3D"gmail_signature"><div dir=3D"ltr">Justin</div></div></div>

--000000000000245ff6059a0febb4--

--===============1321274981==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1321274981==--