I seem to be having an issue with the &synchronized attribute when running in a cluster configuration on the latest stable release, Bro 4.2.1. I’ve condensed it down into a small re-produceable proof of concept.
I took a standard bro install, appended the following POC to local.bro: sync.bro
I configured a manager, 2 proxies and 2 workers: node.cfg
Finally I deployed the configuration and scripts via broctl and checked the output: broctl.stdout
Since the “pids” set has the “&synchronized” attribute one would expect that as each node appends it’s own pid the “pids” set would grow, however this is not the behavior observed.
Am I missing something obvious for this functionality to work?
Thanks,
Luke Young