[
https://issues.apache.org/jira/browse/METRON-514?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15608885#comment-15608885
]
Otto Fowler commented on METRON-514:
------------------------------------
I have seen this problem too, but for me the issue is on the ownership of the
snort alerts.csv
I see permission errors in the flume logs trying to access the files.
It is like once the file rotates the permissions change and flume fails.
Changing permissions will fix until next rotate.
Do you have any actual errors from flume?
> Snort kafka topic fails to get any data on a setup running for several days
> ---------------------------------------------------------------------------
>
> Key: METRON-514
> URL: https://issues.apache.org/jira/browse/METRON-514
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
>
> After a cluster has been running for a while, data will suddenly stop being
> written to the snort Kafka topic. Other topics like yaf and bro continue to
> work. The difference between those sensors and snort is that snort logs are
> fed into Kafka with Flume.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
