Those archive log failure emails are a new feature in version 2.5. The only purpose of the emails is to make it easier to notice when such an error occurs (i.e., these emails do not indicate a new type of error condition). Previously, if such a failure occurred, the only way you would know is if you noticed missing logs in one of the subdirectories of the <PREFIX>/logs/ directory, or if you noticed the presence of a new spool/tmp/post-terminate-* directory.
As for the strange directory names, one possible reason could be your make-archive-name script is producing bad output. On 10/3/16 2:11 PM, Aashish Sharma wrote: > I see notifications as following: > > ----- Forwarded message from Xxxxxxx ----- > > Date: Mon, 3 Oct 2016 11:54:39 -0700 (PDT) > From: > To: > Subject: [bro-cluster] archive log failure > > Unable to archive one or more logs in directory: > /usr/local/bro/spool/tmp/post-terminate-worker-2016-10-03-09-40-35-36665 > Check the post-terminate.out file in that directory for any error messages. > _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
