Zeek Workers cannot communicate with Zeek Proxy/manager - networking

I set up a small zeek cluster and had it working fine. Here's my rough setup:
Proxy/Manager/Logger - 192.168.1.10
Worker-1 - 192.168.1.10 (em1)
Worker-2 - 192.168.1.15 (em1)
Worker-3 - 192.168.1.15 (p1p1)
Worker-4 - 192.168.1.15 (p1p2)
Worker-5 - 192.168.1.16 (em1)
Worker-6 - 192.168.1.16 (p1p1)
Worker-7 - 192.168.1.16 (p1p2)
Everything was going swell. However, now nothing gets brokered except for worker-1 which is local to the proxy/manager/logger. I can do deploy, start, and stop workers through zeekctl. However, peerstatus hangs indefinitely when checking a remote worker.
I've even set up a new cluster on brand new systems starting from scratch with the same issues. This leads me to believe it's in the network but I can't figure out for the life of me what it could be. I know this is vague but does anyone have at least some troubleshooting ideas for me to try?
Let me know what else I can give you. I appreciate any kind of help you can send my way!

Seth Hall nailed it. I messed up the rules without knowing. Thankfully an easy fix. Thanks.

Related

Anaconda connect to network from behind proxy

I see this has been asked before as many people have battled with this, however none of the solutions seems to work for me, or perhaps I am just doing it wrong.
Since yesterday I have been working on a new proxy network, and setting up my windows machine was easy, but I cannot for the life of me get Anaconda to connect. All the answers seem to point to .condarc file to be edited with:
`proxy_servers:
http: https://username:password#blabla.com: port
https: https://username:password#blabla.com: port
`
or some variation on the above.... I have tried just about everything, in different formats etc,to no avail.
The SysAdmin supplied the following Proxy Info:
http=xxx.xxx.xx.x:xxxx; https=xxx.xxx.xx.x:xxxx; ftp=xxx.xxx.xx.x:xxxx; socks=xxxx:XXXX
So what do I need to change and where, as I am at my wits' end with this!
Thank you in advance.
PS: Please show the format as well if the above is wrong. Note, there is no password or username.

xm destroy command hangs indefinitely

Dear Community Members,
I have a situation here ! One of the VM running on OVS 3.2.11 is stuck and I tried to kill it from OVMM but that didn't work. I also tried to use xm destroy command but it hangs indefinitely.
Could you please share your thoughts on how to debug, where to look the logs(I have checked all the default log locations) but no clue. Could you please share what could have been wrong with this VM. All the other VMs responds normal.
Thanks in advance..

Debugging a Google Compute Engine Proxy Server Refusing Connections

Hey so I have three GCE instances set-up which all run the same code. They're cloned from the same snapshot so I'm pretty positive that they're exactly the same.
For some reason, only one of these GCE instances is able to receive connections from external sources. The other two can't. I keep getting a "Connection timedout" error in Firefox.
These instances all have the same network-tags, so they should have the same firewall rules. That is, if you're hitting this problem too, make sure you have the right firewall rules set in the networking tab of your google-cloud center before reading on.
Since they're running the same code and have the same ports open, I have no idea what the problem could be, or how to figure out what it might be.
I was wondering what the best way to debug this might be? I believe they were working earlier but now are no longer working.
Rebooting the instance seemed to fix this. This is not an adequate solution however. I'll update my answer over the coming weeks if it happens again.

prove network is truly unavailable

I have an old school foxpro web app that I am trying to help limp along while I rewrite the system. Every day, multiple times, I get this following error message: The specified network name is no longer available.
Does anyone have any suggestions how to troubleshoot this? Perhaps, prove to my IT guys that there really is a network issue. I have theories, but I have no idea how to prove anything, it always comes back to foxpro sucks rewrite it now.
I'll take any help, tools, and will answer any questions that may clarify this for you.
thanks
We have a very large multi-user VFP application on hundreds of sites. Occasionally you get this sort of problem. It is almost always down to environmental issues.
Had one just recently where a client had two machines continually crashing out of the VFP application. Network IT guys swearing up and down that it's not their problem. But what's this in the System Log of both machines? Why, it's the Broadcom NIC reporting a network link loss detected at the same times the application crashed.
Check if the client and server NICs in your situation can report this.
You could consider writing a small program that pings the network resource periodically. You might just look for a file and if the network is failing and the program cannot find the file email the folks in charge of the network and yourself. This would be an independent app, and best if not written in FoxPro so you can independently prove it is not the application or the language/tool it was written in.
I have seen this when networks have bad wiring, a bad port on the switch/hub, a failing NIC in the mix, and sometimes when the network is just flooded with requests from workstations.
You also did not mention if this was a wireless connection. I am hoping not, but I have seen wireless (especially slower wireless) hubs fail with respect to the network overload and slow and unreliable performance. Especially compared to a wired network.
Rick Schummer
In addition to the comments about IP address, is the setting on the network controller to be energy efficient? and thus turn itself off when not actively in use.

How to find where a connection is failing

I have a website running a basic ASP.NET application that is mostly used from a single location, which is my client's office. The server is at a high-class datacenter.
Whenever I've been testing or using my application from outside their office I have consistently good connections but from their office the connection seems inconsistent. Sometimes requests just don't seem to make it to the server from the browser. I'm not familiar with the network hardware in the office, but they do have a T1 connection which should always be on.
I've tried ping and tracert and everything looks normal. When running Firebug during a failed request the request shows up in the log, then just sits there without showing it is sending any data, eventually it times out.
My question is, what tools can I use to diagnose this connection problem and start to narrow it down to a specific cause so I can fix it? Its an intermittent problem so a long running tool would probably make more sense, if there is any available.
Thanks for any help.
All of your standard ping and traceroute tools are probably your best bet. I'm not understanding though, where is the site located?
If you open command prompt, run ping -t aspwebsiteurl.domain <- will show if there is packet loss.
From command prompt again, tracert aspwebsiteurl.domain <- will show you what route the packet is taking to get the site. May also show you if there is one particular hop that is giving you the hickup.
Is there a proxy between the office and the datacenter that could be causing issues?
Also you could try Wireshark to try to debug the problem in more detail.
Speed Test - Internet Network Connection Speed may be of some help with some links to test out the connection at the client's office to see how well it works.
Another question is how far away is the client and the datacenter? If one is in New York and the other in Los Angeles then the distance apart may be a factor. Also, have you examined any possible DNS issues?

Resources