Zeek config with eth0 does not work

[selroc]

The system has em0 instead of eth0:

==== stderr.log
fatal error: problem with interface eth0 (pcap_error: BIOCSETIF failed: Device not configured (pcap_activate))

==== stdout.log
max memory size (kbytes, -m) unlimited
data seg size (kbytes, -d) 33554432
virtual memory (kbytes, -v) unlimited
core file size (blocks, -c) unlimited

==== .cmdline
-i eth0 -U .status -p zeekctl -p zeekctl-live -p standalone -p local -p zeek local.zeek zeekctl zeekctl/standalone zeekctl/auto

[markoverholser]

How did your config get eth0 in it if that's not an available interface? Did you configure the package using the graphical UI? It should show you a list of interfaces and you select from them. I searched the code base and the phrase 'eth0' appears three times in one file, and all of them are part of comments, i.e. not actually code that affects anything, so I'm not sure how this happened.

[selroc]

Yes I used the graphical UI, selected WAN (em0) from the list of interfaces.

[shadonet]

We will dig deeper about it.

[freakbsd]

@shadonet

Same problem for me, but one small observation.
If I only choose the WAN interface ... it starts without any problems. But if I choose WAN and LAN ... then ... problem.

Thanks,

[freakbsd]

Ah, sorry, forgot about tech details. I use pfSense 2.5.0 fresh installed.

[selroc]

I have an upgrade crash report (to latest pfsense). Relevant part:

<118>[43/53] Upgrading zeek from 3.0.12_2 to 4.0.0...
<118>===> Creating groups.
<118>Using existing group 'zeek'.
<118>===> Creating users
<118>Using existing user 'zeek'.
<118>[43/53] Extracting zeek-4.0.0: .......... done
<6>em0: link state changed to UP
<6>em1: link state changed to UP
<6>em2: link state changed to UP
<6>em3: link state changed to UP
<118>Warning: failed to extract IP addresses from the "ifconfig -a" command output
<118>Warning: failed to find local IP addresses with "ifconfig -a" or "ip address" commands
<118>Traceback (most recent call last):
<118>  File "/usr/local/bin/zeekctl", line 814, in <module>
<118>    sys.exit(main())
<118>  File "/usr/local/bin/zeekctl", line 781, in main
<118>    loop = ZeekCtlCmdLoop(ZeekCtl, interactive, cmd)
<118>  File "/usr/local/bin/zeekctl", line 29, in __init__
<118>    self.zeekctl = zeekctl_class(ui=self)
<118>  File "/usr/local/lib/zeek/python/zeekctl/ZeekControl/zeekctl.py", line 75, in __init__
<118>    zeekscriptdir, self.ui, state)
<118>  File "/usr/local/lib/zeek/python/zeekctl/ZeekControl/config.py", line 73, in __init__
<118>    self.config = self._read_config(cfgfile)
<118>  File "/usr/local/lib/zeek/python/zeekctl/ZeekControl/config.py", line 596, in _read_config
<118>    with open(fname, "r") as f:
<118>PermissionError: [Errno 13] Permission denied: '/usr/local/etc/zeekctl.cfg'

is this helpful ?

[shadonet]

Related to #22