ncsa / bro-doctor Goto Github PK
View Code? Open in Web Editor NEWLicense: Other
License: Other
Some places I check for == "T"
or == "0"
that need to be True or 0 for json logs.
When run with no arguments:
Traceback (most recent call last):
File "/opt/app/bro/bin/broctl", line 833, in
sys.exit(main())
File "/opt/app/bro/bin/broctl", line 809, in main
cmdsuccess = loop.onecmd(cmdline)
File "/usr/local/lib/python2.7/cmd.py", line 220, in onecmd
return self.default(line)
File "/opt/app/bro/bin/broctl", line 54, in default
results = self.broctl.plugincmd(cmd, cmdargs)
File "/opt/app/bro/lib/broctl/BroControl/broctl.py", line 54, in wrapper
return func(self, *args, **kwargs)
File "/opt/app/bro/lib/broctl/BroControl/broctl.py", line 34, in wrapper
return func(self, *args, **kwargs)
File "/opt/app/bro/lib/broctl/BroControl/broctl.py", line 524, in plugincmd
return self.plugins.runCustomCommand(cmd, args, self.ui)
File "/opt/app/bro/lib/broctl/BroControl/pluginreg.py", line 157, in runCustomCommand
return myplugin.cmd_custom(cmd, args, cmdout)
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 388, in cmd_custom
results.ok = f() and results.ok
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 205, in check_capture_loss
for rec in read_bro_logs_with_line_limit(reversed(files), 10000):
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 104, in read_bro_logs_with_line_limit
for rec in read_bro_log(f):
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 97, in read_bro_log
for rec in reader(f):
File "/opt/app/bro/lib/bro/plugins/packages/bro-doctor/doctor.py", line 76, in bro_json_reader
yield json.loads(f)
File "/usr/local/lib/python2.7/json/init.py", line 339, in loads
return _default_decoder.decode(s)
File "/usr/local/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
TypeError: expected string or buffer
note to self:
I think the check needs to be that if bro -N lists the pf_ring plugin, the interface MUST start with pf_ring::
Until https://bro-tracker.atlassian.net/browse/BIT-1864 is fixed, it will be a common problem for people trying to use the native pf_ring plugin.
if pfring_configured is True, pfringclusterid should not be zero.. this should potentially just be checked inside the plugin... The current behavior makes almost no sense.
This is pretty debatable, but we've seen a lot of improvement in disabling Transparent Hugepages. Could be interesting to check if THP are enabled or disabled.
root@idsbox:/usr/local/zeek# zeekctl doctor
Warning: ZeekControl plugin uses legacy BroControl API. Use
'import ZeekControl.plugin' instead of 'import BroControl.plugin'
Doesn't seem to harm operation, at least for now.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.