[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bro
Subject:    [Zeek] Re: Errors in workers using Spicy 1.2.0
From:       Carlos Lopez <clopmz () outlook ! com>
Date:       2021-08-03 14:01:48
Message-ID: 864D7C2D-787D-497F-ABC4-111F1A439B9D () outlook ! com
[Download RAW message or body]

Ok, installed on all Zeek components: workers and manager …. But now Zeek processes \
don't start:

Stderr is:

/opt/zeek/share/zeekctl/scripts/run-zeek: line 110:  1330 Abort trap              \
nohup "$myzeek" "$@"


Best regards,
C. L. Martinez

> On 3 Aug 2021, at 15:54, Benjamin Bannier <benjamin.bannier@corelight.com> wrote:
> 
> Hi Carlos,
> 
> Moving this to the Spicy mailing list.
> 
> > After some problems to install spicy 1.1.0 in my Zeek cluster under FreeBSD \
> > 13-p3, this morning I have tried to install spicy 1.2.0 an all works as expected. \
> > Good work!! …
> 
> That's great to hear.
> 
> > But after installing spicy-plugin and spicy-analysers and executing "zeekctl \
> > deploy" (only in manager side) the following error appears in all workers: 
> > root@stirling:/nsm/zeek/spool/idps-prod # more stderr.log
> > error in /opt/zeek/share/zeek/base/init-bare.zeek, line 1: cannot load plugin \
> > library /opt/zeek/lib/zeek/plugins/packages/spicy-plugin//lib/_Zeek-Spicy.freebsd-amd64.so: \
> > Shared object "libhilti.so" not found, required by "_Zeek-Spicy.freebsd-amd64.so" \
> > fatal error in /opt/zeek/share/zeek/base/init-bare.zeek, line 1: aborting after \
> > plugin errors 
> > Do I need to install spicy in all Zeek cluster components: workers, managers, \
> > loggers, etc?
> 
> Yes, you need to install the same Spicy on all nodes where you expect to deploy \
> spicy-plugin. When you install spicy-plugin it will detect Spicy and its \
> configuration during its build phase; the results of these checks get baked into \
> the plugin, so the setup on the node you build it on (manager) should mirror the \
> target nodes. 
> 
> Cheers,
> 
> Benjamin
> 
> --
> zeek mailing list -- zeek@lists.zeek.org
> To unsubscribe send an email to zeek-leave@lists.zeek.org


--
zeek mailing list -- zeek@lists.zeek.org
To unsubscribe send an email to zeek-leave@lists.zeek.org


[prev in list] [next in list] [prev in thread] [next in thread]