Re: Error on startup

--===============1474833969==
Content-Type: multipart/alternative; boundary="00000000000018a434059b7ecd00"

--00000000000018a434059b7ecd00
Content-Type: text/plain; charset="UTF-8"

This was resolved sidebar.

Listener was holding the process and port.

####

Did you reboot in between the changes? I would do that are perform a...

netstat -tanp | grep 47761 and kill any open associated processes.

INADDR_ANY:47761 tells me something might be open.

On Mon, Jan 6, 2020 at 3:29 PM Scot Harris <[email protected]> wrote:

> I think I caused this problem by trying to change the directory where the
> spool data is processed.
>
>
>
> Changing that back did not correct the problem.
>
>
>
> Unable to startup zeek at this time.
>
>
>
>
>
>
>
> [zeek@heimdallr logger]$ zeekctl start
>
>
>
> Warning: ZeekControl plugin uses legacy BroControl API. Use
>
> 'import ZeekControl.plugin' instead of 'import BroControl.plugin'
>
>
>
> starting logger ...
>
> Error: logger terminated immediately after starting; check output with
> "diag"
>
>
>
>
>
>
>
>
>
> error in
> /opt/zeek/share/zeek/base/frameworks/cluster/./setup-connections.zeek,
> lines 93-95: Failed to listen on INADDR_ANY:47761
> (Broker::listen(Broker::default_listen_address, Cluster::self$p,
> Broker::default_listen_retry))
>
> warning: WriterFrontend cluster/Log::WRITER_ASCII expected 3 fields in
> write, got 4. Skipping line.
>
> fatal error: errors occurred while initializing
>
>
>
>
>
>
>
>
>
> Any ideas appreciated.
>
>
>
> Thank you.
>
>
>
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



-- 

*Patrick Kelley, CISSP, C|EH, ITIL*
*CTO*
[email protected]
(o) 770-224-6482

--00000000000018a434059b7ecd00
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>This was resolved sidebar.</div><div><br></div><div>L=
istener was holding the process and port.</div><div><br></div><div>####</di=
v><div><br></div>Did you reboot in between=C2=A0the changes? I would do tha=
t are perform=C2=A0a...<div><br></div><div>netstat -tanp | grep 47761 and k=
ill any open associated processes.<br><div><br></div><div>INADDR_ANY:47761 =
tells me something might be open.</div></div></div><br><div class=3D"gmail_=
quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jan 6, 2020 at 3:29 PM=
 Scot Harris &lt;<a href=3D"mailto:[email protected]">SHARRIS@hollywo=
odfl.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D=
"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-le=
ft:1ex">





<div lang=3D"EN-US">
<div class=3D"gmail-m_-6289955221000468609WordSection1">
<p class=3D"MsoNormal">I think I caused this problem by trying to change th=
e directory where the spool data is processed.<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Changing that back did not correct the problem.<u></=
u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Unable to startup zeek at this time.<u></u><u></u></=
p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">[zeek@heimdallr logger]$ zeekctl start<u></u><u></u>=
</p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Warning: ZeekControl plugin uses legacy BroControl A=
PI. Use<u></u><u></u></p>
<p class=3D"MsoNormal">&#39;import ZeekControl.plugin&#39; instead of &#39;=
import BroControl.plugin&#39;<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">starting logger ...<u></u><u></u></p>
<p class=3D"MsoNormal">Error: logger terminated immediately after starting;=
 check output with &quot;diag&quot;<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">error in /opt/zeek/share/zeek/base/frameworks/cluste=
r/./setup-connections.zeek, lines 93-95: Failed to listen on INADDR_ANY:477=
61 (Broker::listen(Broker::default_listen_address, Cluster::self$p, Broker:=
:default_listen_retry))<u></u><u></u></p>
<p class=3D"MsoNormal">warning: WriterFrontend cluster/Log::WRITER_ASCII ex=
pected 3 fields in write, got 4. Skipping line.<u></u><u></u></p>
<p class=3D"MsoNormal">fatal error: errors occurred while initializing<u></=
u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Any ideas appreciated.<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Thank you.<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
</div>
</div>

_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div=
 dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"lt=
r"><div><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"=
><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div d=
ir=3D"ltr"><div dir=3D"ltr"><div><br></div><div><b>Patrick Kelley, CISSP, C=
|EH, ITIL</b></div><div><i>CTO</i></div><div><a href=3D"mailto:patrick.kell=
[email protected]" target=3D"_blank">patrick.kelley@criticalpaths=
ecurity.com</a></div><div>(o) 770-224-6482</div></div></div></div></div></d=
iv></div></div></div></div></div></div></div></div></div></div>

--00000000000018a434059b7ecd00--

--===============1474833969==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1474833969==--