Re: Manager, Proxy and Worker all logging the same notice to notice.log
Denny Sabu <[email protected]> Thu, 26 Dec 2019 23:01:32 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <BY5PR11MB4292945A142BCE2B07FA7046FA2B0@BY5PR11MB4292.namprd11.prod.outlook.com> |
--===============0119456745== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_" --_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_ Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable node.cfg is as follows: [manager] type=3Dmanager host=3Dlocalhost interface=3Denp101s0f1 [proxy-1] type=3Dproxy host=3Dlocalhost interface=3Denp101s0f1 [worker-1] type=3Dworker host=3Dlocalhost interface=3Denp101s0f1 lb_method=3Dpf_ring lb_procs=3D16 pin_cpus=3D4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 The notice is SSL::Invalid_Server_Cert Denny Sabu Software Engineer Sensato www.sensato.co<http://www.sensato.co/> [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/facebook_sig= .png]<https://www.facebook.com/SensatoTeam/> [http://cdn2.hubspot.net/hubf= s/184235/dev_images/signature_app/twitter_sig.png] <https://twitter.com/sen= satocybersec> [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_= app/linkedin_sig.png] <https://www.linkedin.com/company/15231342/> ________________________________ From: Justin Azoff <[email protected]> Sent: Thursday, December 26, 2019 5:01 PM To: Denny Sabu <[email protected]> Cc: [email protected] <[email protected]> Subject: Re: [Zeek] Manager, Proxy and Worker all logging the same notice t= o notice.log What is the notice? What does your node.cfg look like? On Thu, Dec 26, 2019 at 3:44 PM Denny Sabu <[email protected]<mailto:De= [email protected]>> wrote: Hello, I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a p= roxy and 16 workers. In notice.log, I see 3 notices for what appears to be = a single event. The 3 notices have the same ts, source, destination, IPs, p= orts, fuids, notes, and msgs but the uid is different for all 3 notices. In= addition the 'peer_descr' value is different for each, with one being the= manager, one the proxy and one the worker. Any help/guidance on the matter would be greatly appreciated. Best, Denny Sabu Software Engineer Sensato www.sensato.co<http://www.sensato.co/> [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/facebook_sig= .png]<https://www.facebook.com/SensatoTeam/> [http://cdn2.hubspot.net/hubf= s/184235/dev_images/signature_app/twitter_sig.png] <https://twitter.com/sen= satocybersec> [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_= app/linkedin_sig.png] <https://www.linkedin.com/company/15231342/> _______________________________________________ Zeek mailing list [email protected]<mailto:[email protected]> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek -- Justin [EXTERNAL MESSAGE]: This e-mail was sent from an external source - use caut= ion and vigilance and don't become attacker fodder! --_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_ Content-Type: text/html; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-2022-= jp"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> node.cfg is as follows:</div> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> <span>[manager]<br> </span> <div>type=3Dmanager<br> </div> <div>host=3Dlocalhost<br> </div> <div>interface=3Denp101s0f1</div> <div><br> </div> <div>[proxy-1]<br> </div> <div>type=3Dproxy<br> </div> <div>host=3Dlocalhost<br> </div> <div>interface=3Denp101s0f1</div> <div><br> </div> <div>[worker-1]<br> </div> <div>type=3Dworker<br> </div> <div>host=3Dlocalhost<br> </div> <div>interface=3Denp101s0f1<br> </div> <div>lb_method=3Dpf_ring<br> </div> <div>lb_procs=3D16<br> </div> <span>pin_cpus=3D4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19</span></div> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> The notice is SSL::Invalid_Server_Cert<br> </div> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> <br> </div> <div id=3D"Signature"> <div></div> <div></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <span style=3D"color:rgb(243,144,29)">Denny Sabu</span></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <span style=3D"color:rgb(0,0,0)"><i>Software Engineer</i></span></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <strong>Sensato</strong></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <a href=3D"http://www.sensato.co/" target=3D"_blank" rel=3D"noopener norefe= rrer" style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-weight:= normal; font-size:14px; color:rgb(29,161,219)"><span style=3D"font-size:10p= t; color:rgb(81,167,249); line-height:normal">www.sensato.co</span></a><spa= n style=3D"color:rgb(81,167,249); font-family:Calibri,Arial,Helvetica,sans-= serif; font-size:10pt; line-height:normal"> </span></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <a href=3D"https://www.facebook.com/SensatoTeam/" target=3D"_blank" rel=3D"= noopener noreferrer" title=3D"Ctrl+Click or tap to follow the link" sty= le=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img = style=3D"border-style:none; width:25px; height:25px; max-width:25px; max-he= ight:25px!important" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images= /signature_app/facebook_sig.png"></a><span style=3D"color:rgb(0,0,0); font-= family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"> </sp= an><a href=3D"https://twitter.com/sensatocybersec" target=3D"_blank" rel=3D= "noopener noreferrer" style=3D"font-family:Calibri,Arial,Helvetica,sans-ser= if; font-size:12pt"><img style=3D"border-style:none; width:25px; height:25p= x; max-width:25px; max-height:25px!important" src=3D"http://cdn2.hubspot.ne= t/hubfs/184235/dev_images/signature_app/twitter_sig.png"></a><span style=3D= "color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-siz= e:12pt"> </span><a href=3D"https://www.linkedin.com/company/1523= 1342/" target=3D"_blank" rel=3D"noopener noreferrer" style=3D"font-family:C= alibri,Arial,Helvetica,sans-serif; font-size:12pt"><img style=3D"border-sty= le:none; width:25px; height:25px; max-width:25px; max-height:25px!important= " src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/link= edin_sig.png"></a></div> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Justin Azoff <just= [email protected]><br> <b>Sent:</b> Thursday, December 26, 2019 5:01 PM<br> <b>To:</b> Denny Sabu <[email protected]><br> <b>Cc:</b> [email protected] <[email protected]><br> <b>Subject:</b> Re: [Zeek] Manager, Proxy and Worker all logging the same n= otice to notice.log</font> <div> </div> </div> <div> <div dir=3D"ltr">What is the notice? What does your node.cfg look lik= e?</div> <br> <div class=3D"x_gmail_quote"> <div dir=3D"ltr" class=3D"x_gmail_attr">On Thu, Dec 26, 2019 at 3:44 PM Den= ny Sabu <<a href=3D"mailto:[email protected]">[email protected]<= /a>> wrote:<br> </div> <blockquote class=3D"x_gmail_quote" style=3D"margin:0px 0px 0px 0.8ex; bord= er-left:1px solid rgb(204,204,204); padding-left:1ex"> <div dir=3D"ltr"> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Hello,</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a p= roxy and 16 workers. In notice.log, I see 3 notices for what appears to be = a single event. The 3 notices have the same ts, source, destination, IPs, p= orts, fuids, notes, and msgs but the uid is different for all 3 notices. In addition the 'peer_descr'= value is different for each, with one being the manager, one the proxy and= one the worker.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Any help/guidance on the matter would be greatly appreciated. <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Best,</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div id=3D"x_gmail-m_-119923988612202668Signature"> <div></div> <div></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <span style=3D"color:rgb(243,144,29)">Denny Sabu</span></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <span style=3D"color:rgb(0,0,0)"><i>Software Engineer</i></span></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <strong>Sensato</strong></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <a href=3D"http://www.sensato.co/" rel=3D"noopener noreferrer" target=3D"_b= lank" style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-weight:= normal; font-size:14px; color:rgb(29,161,219)"><span style=3D"font-size:10p= t; color:rgb(81,167,249); line-height:normal">www.sensato.co</span></a><spa= n style=3D"color:rgb(81,167,249); font-family:Calibri,Arial,Helvetica,sans-= serif; font-size:10pt; line-height:normal"> </span></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <a href=3D"https://www.facebook.com/SensatoTeam/" rel=3D"noopener noreferre= r" title=3D"Ctrl+Click or tap to follow the link" target=3D"_blank" sty= le=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img = style=3D"border-style:none; width:25px; height:25px; max-width:25px; max-he= ight:25px" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images/signature= _app/facebook_sig.png"></a><span style=3D"color:rgb(0,0,0); font-family:Cal= ibri,Arial,Helvetica,sans-serif; font-size:12pt"> </span><a href= =3D"https://twitter.com/sensatocybersec" rel=3D"noopener noreferrer" target= =3D"_blank" style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-s= ize:12pt"><img style=3D"border-style:none; width:25px; height:25px; max-wid= th:25px; max-height:25px" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_i= mages/signature_app/twitter_sig.png"></a><span style=3D"color:rgb(0,0,0); f= ont-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"> = </span><a href=3D"https://www.linkedin.com/company/15231342/" rel=3D"noopen= er noreferrer" target=3D"_blank" style=3D"font-family:Calibri,Arial,Helveti= ca,sans-serif; font-size:12pt"><img style=3D"border-style:none; width:25px;= height:25px; max-width:25px; max-height:25px" src=3D"http://cdn2.hubspot.n= et/hubfs/184235/dev_images/signature_app/linkedin_sig.png"></a></div> </div> </div> _______________________________________________<br> Zeek mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n= oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi= nfo/zeek</a></blockquote> </div> <br clear=3D"all"> <div><br> </div> -- <br> <div dir=3D"ltr" class=3D"x_gmail_signature"> <div dir=3D"ltr">Justin</div> </div> <p></p> <div style=3D""> <p class=3D"x_MsoNormal" style=3D"background:#FFEB9C=1B$B!G=1B(B"><b><span = style=3D"color:#9C6500=1B$B!l=1B(B"></span></b><span style=3D"color:black= =1B$B!G=1B(B">[EXTERNAL MESSAGE]: This e-mail was sent from an external sou= rce - use caution and vigilance and don't become attacker fodder!</span></p= > </div> </div> </body> </html> --_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_-- --===============0119456745== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============0119456745==--