We are gearing up for a Bro 1.5 release and would like to solicit
some testing of the current codebase to weed out any potentially
remaining issues ahead of time.
This applies in particular to a new
installation/configuration/maintenance framework called
"BroControl", which will ship as part of Bro 1.5, replacing the old
BroLite system that has already been deprecated for a while now.
BroControl allows for easy operation of a Bro setup, both for
standard single-system installations as well as in cluster setups.
It includes functionality for configuration, log archival, mail
notifications, dynamic updates, and general monitoring.
We'd much appreciate if folks could give our current development
version of Bro 1.5 and BroControl a try. In particular, trying
BroControl in both standalone and cluster operation on different
operating systems would be very helpful. So far, FreeBSD has seen
most testing, MacOS quite a bit, Linux only a little bit.
To get a copy of the current code base, use SVN:
svn checkout http://svn.icir.org/bro/trunk/bro
You need to run "./autogen.sh" after the checkout before proceeding
with the normal ./configure.
The default installation process should work as usual. For using
BroControl, see its documentation at
http://svn.icir.org/bro/trunk/bro/aux/broctl/README.html
If you find any problems, or something important missing, please
file a ticket with the Bro issue tracker at
When filing a ticket regarding BroControl, please make sure to set
the ticket's component to "BroControl".
For folks running a previous version of the "cluster shell" from my
work-branch: BroControl is more or less a rebranding of the shell
and supersedes all previous versions. See below for update
instructions.
Finally, if you give this version try, please drop me a quick mail
even if things are going smoothly for you so that we can keep track
the testing this version has seen.
Thanks a lot in advance,
Robin
--------- Update instruction ---------------------------------------------
For those folks already running a cluster installation using my work
branch updating to trunk with broctl should be easy. Just follow
these steps:
1. Backup the following files:
- All *.cfg files found in $prefix/etc
- The current set of logs in $prefix/logs
- Your site policies if they are installed somewhere under $prefix
2. Delete $prefix on all nodes (or at least anything Bro related in
there).
3. Follow the installation instructions in
http://svn.icir.org/bro/trunk/bro/aux/broctl/README.html
Skip the steps involving any of the *.cfg files.
Make sure to update the cron entry to use "broctl" instead of
"cluster".
4. Copy the saved files back into place:
- Copy all *.cfg back into $prefix/etc. Rename "cluster.cfg" to
"broctl.cfg".
- Copy the logs back into $prefix/logs.
- Copy your site policies back. The new default location for them
is $prefix/share/bro/policy/local. Copy them there or to whatever
path your broctl.cfg specifies.
6. Run "broctl install", then "broctl check" to make sure everythign
works as expected.
Generally, everything should be working as before. The main
differences to the old cluster shell are (1) the executable is now
called "broctl" instead of "cluster"; and (2) "broctl install" does
no longer copy any files from the Bro distribution directory into
the installation; you need to rerun "make install-broctl" if
anything inside the Bro distribution has changed (like after an "svn
update").