Never mind, looks like I need to do a make install-brolite and them look at the /etc/bro.cfg file.
Thanks.
--- On Thu, 1/29/09, Martin Fontanez <jdmfontz(a)yahoo.com> wrote:
From: Martin Fontanez <jdmfontz(a)yahoo.com>
Subject: Log Files
To: Bro(a)bro-ids.org
Date: Thursday, January 29, 2009, 2:57 PM
Just got Bro up and running. How do I configure where log files are written to?
Thanks,
Martin
Hello. Thank you. It looks like I have gcc and c++ pkgs installed.
[root@localhost opt]# rpm -qa | grep gcc
compat-gcc-34-c++-3.4.6-4
compat-libgcc-296-2.96-138
compat-gcc-34-3.4.6-4
libgcc-4.1.2-42.el5
gcc-4.1.2-42.el5
compat-gcc-34-g77-3.4.6-4
[root@localhost opt]#
It looks like I also have g++ which gets installed as part of gcc install. Does this looks like a bro bug?
[root@localhost opt]# find / -name "g++*"
/usr/bin/g++34
/opt/gcc-4.3.3/gcc/cp/g++spec.c
[root@localhost opt]#
Regards,
Martin
--- On Fri, 1/23/09, rmkml <rmkml(a)free.fr> wrote:
From: rmkml <rmkml(a)free.fr>
Subject: Re: [Bro] Bro-1.4 Install Question
To: "Martin Fontanez" <jdmfontz(a)yahoo.com>
Date: Friday, January 23, 2009, 8:06 AM
Hi,
need c++ compilator...
Regards
Rmkml
Crusoe-Researches.com
On Fri, 23 Jan 2009, Martin Fontanez wrote:
> Date: Fri, 23 Jan 2009 06:35:01 -0800 (PST)
> From: Martin Fontanez <jdmfontz(a)yahoo.com>
> To: Bro(a)bro-ids.org, Christian Kreibich <christian(a)whoop.org>
> Subject: Re: [Bro] Bro-1.4 Install Question
>
> I installed the ncurses-devel pkg and ./configure ran ok. Now I am
getting the following errors on make:
>
> Making all in lib
> make[6]: Entering directory `/opt/bro-1.4/aux/binpac/lib'
> source='binpac_buffer.cc' object='binpac_buffer.o'
libtool=no \
> DEPDIR=.deps depmode=none /bin/sh ../depcomp \
> g++ -DHAVE_CONFIG_H -I. -I. -I.. -c -o
binpac_buffer.o binpac_buffer.cc
> ../depcomp: line 414: exec: g++: not found
> make[6]: *** [binpac_buffer.o] Error 127
> make[6]: Leaving directory `/opt/bro-1.4/aux/binpac/lib'
> make[5]: *** [all-recursive] Error 1
> make[5]: Leaving directory `/opt/bro-1.4/aux/binpac'
> make[4]: *** [all] Error 2
> make[4]: Leaving directory `/opt/bro-1.4/aux/binpac'
> make[3]: *** [all-recursive] Error 1
> make[3]: Leaving directory `/opt/bro-1.4/aux'
> make[2]: *** [all] Error 2
> make[2]: Leaving directory `/opt/bro-1.4/aux'
> make[1]: *** [all-recursive] Error 1
> make[1]: Leaving directory `/opt/bro-1.4'
> make: *** [all] Error 2
> [root@localhost bro-1.4]#
>
> Thanks,
>
> Martin
>
> --- On Thu, 1/22/09, Christian Kreibich <christian(a)whoop.org> wrote:
> From: Christian Kreibich <christian(a)whoop.org>
> Subject: Re: [Bro] Bro-1.4 Install Question
> To: jdmfontz(a)yahoo.com
> Cc: Bro(a)bro-ids.org
> Date: Thursday, January 22, 2009, 3:49 PM
>
> On Wed, 2009-01-21 at 11:28 -0800, Martin Fontanez wrote:
> > I am getting a "no terminal emulation library found" error
on
> > configure yet as you can see below ncurse and termcap packages are
> > installed. I am using RedHat Linux EL5. Does
> anyone have an idea of
> > why is that? Thanks in advance.
> Please install the -devel packages as well, and let us know how it
> goes. -- Cheers,
> Christian
>
>
>
>
Thanks everyone for all the comments and help. After removing an install of /opt/libpcap-0.9.8 since I had libpcap-0.9.4-12.el5 also installed; and re-running ./configure, make ran without errors. So did make install. Looks like my box is up and running.
Thank you!
Martin
PS. Looks like Bro INSTALL doc file might need updating to indicate that corresponding *-devel-* packages also need to be installed.
--- On Tue, 1/27/09, Martin Fontanez <jdmfontz(a)yahoo.com> wrote:
From: Martin Fontanez <jdmfontz(a)yahoo.com>
Subject: Re: [Bro] Bro-1.4 Install Question
To: Bro(a)bro-ids.org, "rmkml" <rmkml(a)free.fr>
Date: Tuesday, January 27, 2009, 1:20 PM
Update. I created a link /usr/bin/g++ for /usr/bin/g++34 and went pass this error on make. Now I am getting this error on make:
source='X509.cc' object='X509.o' libtool=no \
DEPDIR=.deps depmode=none /bin/sh ../depcomp \
g++ -DHAVE_CONFIG_H -I. -I. -I.. -I. -I../aux/binpac/lib -I../src -I. -I.. -Ilibedit -I/opt/libpcap-0.9.8 -I../linux-include -I/usr/local/include -O -W -Wall -Wno-unused -I/opt/libpcap-0.9.8 -I../linux-include -I/usr/local/include -c -o X509.o X509.cc
X509.cc: In function `X509* d2i_X509_(X509**, const u_char**, int)':
X509.cc:18: error: invalid conversion from `u_char**' to `const unsigned char**'
X509.cc:18: error: initializing argument 2 of `X509* d2i_X509(X509**, const
unsigned char**, long int)'
make[3]: *** [X509.o] Error 1
make[3]: Leaving directory `/opt/bro-1.4/src'
make[2]: *** [all] Error 2
make[2]: Leaving directory `/opt/bro-1.4/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/opt/bro-1.4'
make: *** [all] Error 2
[root@localhost bro-1.4]#
Any help is appreciated.
Thank you,
Martin
--- On Tue, 1/27/09, Martin Fontanez <jdmfontz(a)yahoo.com> wrote:
From: Martin Fontanez <jdmfontz(a)yahoo.com>
Subject: Re: [Bro] Bro-1.4 Install Question
To: Bro(a)bro-ids.org, "rmkml" <rmkml(a)free.fr>
Date: Tuesday, January 27, 2009, 10:56 AM
Hello. Thank you. It looks like I have gcc and c++ pkgs installed.
[root@localhost opt]# rpm -qa | grep gcc
compat-gcc-34-c++-3.4.6-4
compat-libgcc-296-2.96-138
compat-gcc-34-3.4.6-4
libgcc-4.1.2-42.el5
gcc-4.1.2-42.el5
compat-gcc-34-g77-3.4.6-4
[root@localhost opt]#
It looks like I also have g++ which gets installed as part of gcc install. Does this looks like a bro bug?
[root@localhost opt]# find / -name "g++*"
/usr/bin/g++34
/opt/gcc-4.3.3/gcc/cp/g++spec.c
[root@localhost opt]#
Regards,
Martin
--- On Fri, 1/23/09, rmkml <rmkml(a)free.fr> wrote:
From: rmkml <rmkml(a)free.fr>
Subject: Re: [Bro]
Bro-1.4 Install Question
To: "Martin
Fontanez" <jdmfontz(a)yahoo.com>
Date: Friday, January 23, 2009, 8:06 AM
Hi,
need c++ compilator...
Regards
Rmkml
Crusoe-Researches.com
On Fri, 23 Jan 2009, Martin Fontanez wrote:
> Date: Fri, 23 Jan 2009 06:35:01 -0800 (PST)
> From: Martin Fontanez <jdmfontz(a)yahoo.com>
> To: Bro(a)bro-ids.org, Christian Kreibich <christian(a)whoop.org>
> Subject: Re: [Bro] Bro-1.4 Install Question
>
> I installed the ncurses-devel pkg and ./configure ran ok. Now I am
getting the following errors on make:
>
> Making all in lib
> make[6]: Entering directory `/opt/bro-1.4/aux/binpac/lib'
> source='binpac_buffer.cc' object='binpac_buffer.o'
libtool=no \
> DEPDIR=.deps depmode=none /bin/sh ../depcomp \
> g++ -DHAVE_CONFIG_H -I. -I.
-I.. -c -o
binpac_buffer.o binpac_buffer.cc
> ../depcomp: line 414: exec: g++: not found
> make[6]: *** [binpac_buffer.o] Error 127
> make[6]: Leaving directory `/opt/bro-1.4/aux/binpac/lib'
> make[5]: *** [all-recursive] Error 1
> make[5]: Leaving directory `/opt/bro-1.4/aux/binpac'
> make[4]: *** [all] Error 2
> make[4]: Leaving directory `/opt/bro-1.4/aux/binpac'
> make[3]: *** [all-recursive] Error 1
> make[3]: Leaving directory `/opt/bro-1.4/aux'
> make[2]: *** [all] Error 2
> make[2]: Leaving directory `/opt/bro-1.4/aux'
> make[1]: *** [all-recursive] Error 1
> make[1]: Leaving directory `/opt/bro-1.4'
> make: *** [all] Error 2
> [root@localhost bro-1.4]#
>
> Thanks,
>
> Martin
>
> --- On Thu, 1/22/09, Christian Kreibich <christian(a)whoop.org> wrote:
> From: Christian
Kreibich <christian(a)whoop.org>
> Subject: Re: [Bro] Bro-1.4 Install Question
> To: jdmfontz(a)yahoo.com
> Cc: Bro(a)bro-ids.org
> Date: Thursday, January 22, 2009, 3:49 PM
>
> On Wed, 2009-01-21 at 11:28 -0800, Martin Fontanez wrote:
> > I am getting a "no terminal emulation library found" error
on
> > configure yet as you can see below ncurse and termcap packages are
> > installed. I am using RedHat Linux EL5. Does
> anyone have an idea of
> > why is that? Thanks in advance.
> Please install the -devel packages as well, and let us know how it
> goes. -- Cheers,
> Christian
>
>
>
>
_______________________________________________
Bro mailing list
bro(a)bro-ids.org
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
We are very new to the Bro environment, and are learning as we go. We
have managed to install Bro and get the Brolite environment working. We
would like to filter a range of IP addresses, and haven't quite been able
to figure out how to do this. Any help would be greatly appreciated.
Thanks.
Norbert
I am getting a "no terminal emulation library found" error on configure yet as you can see below ncurse and termcap packages are installed. I am using RedHat Linux EL5. Does anyone have an idea of why is that? Thanks in advance.
configure: error: No terminal emulation library found! Consider installing termcap, curses, or ncurses.
[root@localhost bro-1.4]# rpm -qa | grep ncurse*
ncurses-5.5-24.20060715
[root@localhost bro-1.4]# rpm -qa | grep termcap
termcap-5.5-1.20060701.1
libtermcap-2.0.8-46.1
[root@localhost bro-1.4]# rpm -qa | grep curses
ncurses-5.5-24.20060715
[root@localhost bro-1.4]#
Hello, and thanks to everyone (especially Robin) who responded to my
questions about geting Bro configured on an Ubuntu system.
Now that we have Bro running, we would like to be able to run more than
one copy to take advantage of a multi-core machine. We are working on the
theory that assigning separate copies of Bro to different processors may
improve performance if we separate some of the tasks that each copy needs
to perform.
We tried simply copying the bro.rc file and calling it bro2.rc, but this
doesn't work. We're a bit new at this, so any help would be appreciated.
Regards,
Norbert
Hello,
I apologize if this message shows up twice. I tried sending it to one
address indicated in some documentation, and then another address provided
as part of my confirmation to joining this list.
We are a group of students working on our fourth year project at the
University of Calgary. As part of our project, we need to install Bro on
an Ubuntu system. We are working with the current version of Ubuntu and
Bro.
The error message looks as follows:
make[1]: Leaving directory '/home/terminator/bro-1.4/aux'
/bin/chown -R 'cat scripts/bro_user_id' /usr/local/bro/
cat: scripts/bro_user_id: No such file or directory
/bin/chown: missing operand after '/usr/local/bro/'
Try '/bin/chown --help' for more information
make: [install-brolite] Error 1 (ignored)
*********************************************************
Please run "/usr/local/bro/etc/bro.rc --start" to start bro
*********************************************************
The file /usr/local/bro/etc/bro.rc also does not exist. Any help you
could offer would be very much appreciated.
Norbert Lange
Hi there
I am new to Bro and the list so Greetings.
Some feedback as requested.
I am installing on Slackware 10.2.0 (old I know) gcc version 3.3.6,
which was pretty straight forward although I have snort/libpcap etc
installed from source and a PF Ring kernel so it is far from a vanilla
Slackware. I had done a 'manual' install of Bro 1.4 prior to patching
Bro for a BroLite install, I deleted and re-installed as I felt that I
had missed a few things which did turn out to be the case e.g the perl
reporting scripts.
On patching and running "make install-brolite" all seems good 'out of
the box' except I had to add "/usr/local/bro/site" to BROPATH in
etc/bro.cfg, from my reading I gather this is likely due to a new
location of site to share/bro/site? A suggestion, possibly a simple
'what goes where' or 'what is to be expected where' in the docs?
Peter
Peter Hart-Davis
Senior Technical Engineer: MWEB IT Security Team
Multichoice Subscriber Management services: Internet Division
Tel.: + 27 021 596 8103
Cell: + 27 083 414 7455
Fax: + 27 021 596 8381
E-mail: phartdavis(a)mweb.com
Registered Linux User #28564
Registered CISSP #89701
MSN: trip_tango(a)hotmail.com
New from MWEB: Cellphone and Internet bundles! Bundle your Internet access with your cellular contract from R75 per month.
Call 08600 32000 or click here(http://www.mweb.co.za/productsservices/MTALKMobile/tabid/1223/Default.aspx) for more info on the great deals available.
MWEB :-) JUST LIKE THAT
This electronic communication and the attached file(s) are subject to a disclaimer which can be accessed on the following link: Disclaimer - or copy the
following URL into your browser - http://www.mweb.co.za/disclaimer.
If you are unable to view the disclaimer, please contact abuse(a)mweb.com for a copy.
Hello,
We are a group of students working on our fourth year project at the
University of Calgary. As part of our project, we need to install Bro on
an Ubuntu system. We are working with the current version of Ubuntu and
Bro.
The error message looks as follows:
make[1]: Leaving directory '/home/terminator/bro-1.4/aux'
/bin/chown -R 'cat scripts/bro_user_id' /usr/local/bro/
cat: scripts/bro_user_id: No such file or directory
/bin/chown: missing operand after '/usr/local/bro/'
Try '/bin/chown --help' for more information
make: [install-brolite] Error 1 (ignored)
*********************************************************
Please run "/usr/local/bro/etc/bro.rc --start" to start bro
*********************************************************
The file /usr/local/bro/etc/bro.rc also does not exist. Any help you
could offer would be very much appreciated.
Norbert Lange