Re: Manager, Proxy and Worker all logging the same notice to notice.log

Denny Sabu <[email protected]> Thu, 26 Dec 2019 23:01:32 +0000
Newsgroups gmane.comp.security.detection.bro
Message-ID <BY5PR11MB4292945A142BCE2B07FA7046FA2B0@BY5PR11MB4292.namprd11.prod.outlook.com>
--===============0119456745==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_"

--_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_
Content-Type: text/plain; charset="iso-2022-jp"
Content-Transfer-Encoding: quoted-printable

node.cfg is as follows:

[manager]
type=3Dmanager
host=3Dlocalhost
interface=3Denp101s0f1

[proxy-1]
type=3Dproxy
host=3Dlocalhost
interface=3Denp101s0f1

[worker-1]
type=3Dworker
host=3Dlocalhost
interface=3Denp101s0f1
lb_method=3Dpf_ring
lb_procs=3D16
pin_cpus=3D4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19

The notice is SSL::Invalid_Server_Cert

Denny Sabu
Software Engineer
Sensato
www.sensato.co<http://www.sensato.co/>
[http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/facebook_sig=
.png]<https://www.facebook.com/SensatoTeam/>  [http://cdn2.hubspot.net/hubf=
s/184235/dev_images/signature_app/twitter_sig.png] <https://twitter.com/sen=
satocybersec>   [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_=
app/linkedin_sig.png] <https://www.linkedin.com/company/15231342/>
________________________________
From: Justin Azoff <[email protected]>
Sent: Thursday, December 26, 2019 5:01 PM
To: Denny Sabu <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Zeek] Manager, Proxy and Worker all logging the same notice t=
o notice.log

What is the notice?  What does your node.cfg look like?

On Thu, Dec 26, 2019 at 3:44 PM Denny Sabu <[email protected]<mailto:De=
[email protected]>> wrote:
Hello,

I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a p=
roxy and 16 workers. In notice.log, I see 3 notices for what appears to be =
a single event. The 3 notices have the same ts, source, destination, IPs, p=
orts, fuids, notes, and msgs but the uid is different for all 3 notices. In=
 addition the  'peer_descr' value is different for each, with one being the=
 manager, one the proxy and one the worker.

Any help/guidance on the matter would be greatly appreciated.

Best,

Denny Sabu
Software Engineer
Sensato
www.sensato.co<http://www.sensato.co/>
[http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/facebook_sig=
.png]<https://www.facebook.com/SensatoTeam/>  [http://cdn2.hubspot.net/hubf=
s/184235/dev_images/signature_app/twitter_sig.png] <https://twitter.com/sen=
satocybersec>   [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_=
app/linkedin_sig.png] <https://www.linkedin.com/company/15231342/>
_______________________________________________
Zeek mailing list
[email protected]<mailto:[email protected]>
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek


--
Justin

[EXTERNAL MESSAGE]: This e-mail was sent from an external source - use caut=
ion and vigilance and don't become attacker fodder!

--_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_
Content-Type: text/html; charset="iso-2022-jp"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-2022-=
jp">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
node.cfg is as follows:</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<span>[manager]<br>
</span>
<div>type=3Dmanager<br>
</div>
<div>host=3Dlocalhost<br>
</div>
<div>interface=3Denp101s0f1</div>
<div><br>
</div>
<div>[proxy-1]<br>
</div>
<div>type=3Dproxy<br>
</div>
<div>host=3Dlocalhost<br>
</div>
<div>interface=3Denp101s0f1</div>
<div><br>
</div>
<div>[worker-1]<br>
</div>
<div>type=3Dworker<br>
</div>
<div>host=3Dlocalhost<br>
</div>
<div>interface=3Denp101s0f1<br>
</div>
<div>lb_method=3Dpf_ring<br>
</div>
<div>lb_procs=3D16<br>
</div>
<span>pin_cpus=3D4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19</span></div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
The notice is SSL::Invalid_Server_Cert<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id=3D"Signature">
<div></div>
<div></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<span style=3D"color:rgb(243,144,29)">Denny Sabu</span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<span style=3D"color:rgb(0,0,0)"><i>Software Engineer</i></span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<strong>Sensato</strong></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<a href=3D"http://www.sensato.co/" target=3D"_blank" rel=3D"noopener norefe=
rrer" style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-weight:=
normal; font-size:14px; color:rgb(29,161,219)"><span style=3D"font-size:10p=
t; color:rgb(81,167,249); line-height:normal">www.sensato.co</span></a><spa=
n style=3D"color:rgb(81,167,249); font-family:Calibri,Arial,Helvetica,sans-=
serif; font-size:10pt; line-height:normal">&nbsp;&nbsp;</span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<a href=3D"https://www.facebook.com/SensatoTeam/" target=3D"_blank" rel=3D"=
noopener noreferrer" title=3D"Ctrl&#43;Click or tap to follow the link" sty=
le=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img =
style=3D"border-style:none; width:25px; height:25px; max-width:25px; max-he=
ight:25px!important" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images=
/signature_app/facebook_sig.png"></a><span style=3D"color:rgb(0,0,0); font-=
family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">&nbsp;&nbsp;</sp=
an><a href=3D"https://twitter.com/sensatocybersec" target=3D"_blank" rel=3D=
"noopener noreferrer" style=3D"font-family:Calibri,Arial,Helvetica,sans-ser=
if; font-size:12pt"><img style=3D"border-style:none; width:25px; height:25p=
x; max-width:25px; max-height:25px!important" src=3D"http://cdn2.hubspot.ne=
t/hubfs/184235/dev_images/signature_app/twitter_sig.png"></a><span style=3D=
"color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-siz=
e:12pt">&nbsp;&nbsp;</span><a href=3D"https://www.linkedin.com/company/1523=
1342/" target=3D"_blank" rel=3D"noopener noreferrer" style=3D"font-family:C=
alibri,Arial,Helvetica,sans-serif; font-size:12pt"><img style=3D"border-sty=
le:none; width:25px; height:25px; max-width:25px; max-height:25px!important=
" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/link=
edin_sig.png"></a></div>
</div>
<div id=3D"appendonsend"></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Justin Azoff &lt;just=
[email protected]&gt;<br>
<b>Sent:</b> Thursday, December 26, 2019 5:01 PM<br>
<b>To:</b> Denny Sabu &lt;[email protected]&gt;<br>
<b>Cc:</b> [email protected] &lt;[email protected]&gt;<br>
<b>Subject:</b> Re: [Zeek] Manager, Proxy and Worker all logging the same n=
otice to notice.log</font>
<div>&nbsp;</div>
</div>
<div>
<div dir=3D"ltr">What is the notice?&nbsp; What does your node.cfg look lik=
e?</div>
<br>
<div class=3D"x_gmail_quote">
<div dir=3D"ltr" class=3D"x_gmail_attr">On Thu, Dec 26, 2019 at 3:44 PM Den=
ny Sabu &lt;<a href=3D"mailto:[email protected]">[email protected]<=
/a>&gt; wrote:<br>
</div>
<blockquote class=3D"x_gmail_quote" style=3D"margin:0px 0px 0px 0.8ex; bord=
er-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
Hello,</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a p=
roxy and 16 workers. In notice.log, I see 3 notices for what appears to be =
a single event. The 3 notices have the same ts, source, destination, IPs, p=
orts, fuids, notes, and msgs but
 the uid is different for all 3 notices. In addition the&nbsp; 'peer_descr'=
 value is different for each, with one being the manager, one the proxy and=
 one the worker.</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
Any help/guidance on the matter would be greatly appreciated. <br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
Best,</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div id=3D"x_gmail-m_-119923988612202668Signature">
<div></div>
<div></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<span style=3D"color:rgb(243,144,29)">Denny Sabu</span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<span style=3D"color:rgb(0,0,0)"><i>Software Engineer</i></span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<strong>Sensato</strong></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<a href=3D"http://www.sensato.co/" rel=3D"noopener noreferrer" target=3D"_b=
lank" style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-weight:=
normal; font-size:14px; color:rgb(29,161,219)"><span style=3D"font-size:10p=
t; color:rgb(81,167,249); line-height:normal">www.sensato.co</span></a><spa=
n style=3D"color:rgb(81,167,249); font-family:Calibri,Arial,Helvetica,sans-=
serif; font-size:10pt; line-height:normal">&nbsp;&nbsp;</span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<a href=3D"https://www.facebook.com/SensatoTeam/" rel=3D"noopener noreferre=
r" title=3D"Ctrl&#43;Click or tap to follow the link" target=3D"_blank" sty=
le=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img =
style=3D"border-style:none; width:25px; height:25px; max-width:25px; max-he=
ight:25px" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images/signature=
_app/facebook_sig.png"></a><span style=3D"color:rgb(0,0,0); font-family:Cal=
ibri,Arial,Helvetica,sans-serif; font-size:12pt">&nbsp;&nbsp;</span><a href=
=3D"https://twitter.com/sensatocybersec" rel=3D"noopener noreferrer" target=
=3D"_blank" style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-s=
ize:12pt"><img style=3D"border-style:none; width:25px; height:25px; max-wid=
th:25px; max-height:25px" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_i=
mages/signature_app/twitter_sig.png"></a><span style=3D"color:rgb(0,0,0); f=
ont-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">&nbsp;&nbsp;=
</span><a href=3D"https://www.linkedin.com/company/15231342/" rel=3D"noopen=
er noreferrer" target=3D"_blank" style=3D"font-family:Calibri,Arial,Helveti=
ca,sans-serif; font-size:12pt"><img style=3D"border-style:none; width:25px;=
 height:25px; max-width:25px; max-height:25px" src=3D"http://cdn2.hubspot.n=
et/hubfs/184235/dev_images/signature_app/linkedin_sig.png"></a></div>
</div>
</div>
_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a></blockquote>
</div>
<br clear=3D"all">
<div><br>
</div>
-- <br>
<div dir=3D"ltr" class=3D"x_gmail_signature">
<div dir=3D"ltr">Justin</div>
</div>
<p></p>
<div style=3D"">
<p class=3D"x_MsoNormal" style=3D"background:#FFEB9C=1B$B!G=1B(B"><b><span =
style=3D"color:#9C6500=1B$B!l=1B(B"></span></b><span style=3D"color:black=
=1B$B!G=1B(B">[EXTERNAL MESSAGE]: This e-mail was sent from an external sou=
rce - use caution and vigilance and don't become attacker fodder!</span></p=
>
</div>
</div>
</body>
</html>

--_000_BY5PR11MB4292945A142BCE2B07FA7046FA2B0BY5PR11MB4292namp_--

--===============0119456745==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0119456745==--