ncsa / bro-doctor Goto Github PK

When run with no arguments:

Traceback (most recent call last):
File "/opt/app/bro/bin/broctl", line 833, in
sys.exit(main())
File "/opt/app/bro/bin/broctl", line 809, in main
cmdsuccess = loop.onecmd(cmdline)
File "/usr/local/lib/python2.7/cmd.py", line 220, in onecmd
return self.default(line)
File "/opt/app/bro/bin/broctl", line 54, in default
results = self.broctl.plugincmd(cmd, cmdargs)
File "/opt/app/bro/lib/broctl/BroControl/broctl.py", line 54, in wrapper
return func(self, *args, **kwargs)
File "/opt/app/bro/lib/broctl/BroControl/broctl.py", line 34, in wrapper
return func(self, *args, **kwargs)
File "/opt/app/bro/lib/broctl/BroControl/broctl.py", line 524, in plugincmd
return self.plugins.runCustomCommand(cmd, args, self.ui)
File "/opt/app/bro/lib/broctl/BroControl/pluginreg.py", line 157, in runCustomCommand
return myplugin.cmd_custom(cmd, args, cmdout)
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 388, in cmd_custom
results.ok = f() and results.ok
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 205, in check_capture_loss
for rec in read_bro_logs_with_line_limit(reversed(files), 10000):
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 104, in read_bro_logs_with_line_limit
for rec in read_bro_log(f):
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 97, in read_bro_log
for rec in reader(f):
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 76, in bro_json_reader
yield json.loads(f)
File "/usr/local/lib/python2.7/json/init.py", line 339, in loads
return _default_decoder.decode(s)
File "/usr/local/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
TypeError: expected string or buffer

Until https://bro-tracker.atlassian.net/browse/BIT-1864 is fixed, it will be a common problem for people trying to use the native pf_ring plugin.

if pfring_configured is True, pfringclusterid should not be zero.. this should potentially just be checked inside the plugin... The current behavior makes almost no sense.

This is pretty debatable, but we've seen a lot of improvement in disabling Transparent Hugepages. Could be interesting to check if THP are enabled or disabled.

note to self:

I think the check needs to be that if bro -N lists the pf_ring plugin, the interface MUST start with pf_ring::

root@idsbox:/usr/local/zeek# zeekctl doctor

Warning: ZeekControl plugin uses legacy BroControl API. Use
'import ZeekControl.plugin' instead of 'import BroControl.plugin'

Doesn't seem to harm operation, at least for now.

Some places I check for == "T" or == "0" that need to be True or 0 for json logs.