zeek stopping

[mbaki]

Hi all,

I am running SO 2.3.120 and having issues starting zeek.

I ran the following command

docker exec -it so-zeek /opt/zeek/bin/zeekctl diag

No core file found and gdb is not installed. It is recommended to
install gdb so that ZeekControl can output a backtrace if Zeek crashes.

Zeek 4.0.6
Linux 3.10.0-1160.59.1.el7.x86_64

Zeek plugins:
Corelight::CommunityID - "Community ID" flow hash support in the connection log (dynamic, version 3.2.0)
Zeek::AF_Packet - Packet acquisition via AF_Packet (dynamic, version 2.1.2)

==== No reporter.log

==== stderr.log
/opt/zeek/share/zeekctl/scripts/run-zeek: line 61: ulimit: core file size: cannot modify limit: Operation not permitted
fatal error: problem with interface af_packet::bond0 (Cannot allocate memory)

==== stdout.log
max memory size (kbytes, -m) unlimited
data seg size (kbytes, -d) unlimited
virtual memory (kbytes, -v) unlimited
core file size (blocks, -c) 0

==== .cmdline
-i af_packet::bond0 -U .status -p zeekctl -p zeekctl-live -p local -p worker-1-1 local.zeek zeekctl base/frameworks/cluster zeekctl/auto

==== .env_vars
PATH=/opt/zeek/bin:/opt/zeek/share/zeekctl/scripts:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ZEEKPATH=/nsm/zeek/spool/installed-scripts-do-not-touch/site::/nsm/zeek/spool/installed-scripts-do-not-touch/auto:/opt/zeek/share/zeek:/opt/zeek/share/zeek/policy:/opt/zeek/share/zeek/site
CLUSTER_NODE=worker-1-1

==== .status
TERMINATED [fatal_error]

==== No prof.log

==== No packet_filter.log

==== No loaded_scripts.log

[mbaki]

I rebooted and zeek is back up.