dovehawk
dovehawk copied to clipboard
Error with Zeek 4.0.5 LTS
Good morning,
After updating my zeek nodes from 4.0.4 to 4.0.5, I am receiving the following errors when I try to retrieve events from my internal MISP instance:
{"ts":"2022-01-31T08:51:05.607207Z","level":"Reporter::ERROR","message":"curl --header "Authorization: "HZt3bmlDstJZq7Wuy0NUARfGLCKAjFF8zogCA9oa"" -s -g -o ""/tmp/zeek-activehttp-FNJSb0Kya4_body"" -D ""/tmp/zeek-activehttp-FNJSb0Kya4_headers"" -X ""GET"" -m 60 -k ""https://iceland.lab.uxdom.org/attributes/bro/download/all"" && touch "/tmp/zeek-activehttp-FNJSb0Kya4_body" |/Input::READER_RAW: Child process exited with non-zero return code 28","location":""} {"ts":"2022-01-31T08:51:05.607661Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-FNJSb0Kya4_body/Input::READER_RAW: Init: cannot open /tmp/zeek-activehttp-FNJSb0Kya4_body","location":""} {"ts":"2022-01-31T08:51:05.607661Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-FNJSb0Kya4_body/Input::READER_RAW: Init failed","location":""} {"ts":"2022-01-31T08:51:05.607661Z","level":"Reporter::ERROR","message":"/tmp/zeek-activehttp-FNJSb0Kya4_body/Input::READER_RAW: terminating thread","location":""}
Auth key is valid for sure (retrieving events using curl works without problems).
Any idea?