Hello all, We are still having a problem with our Bro cluster and logging. During peak times the manager will slowly consume all available memory while the logs sent to disk are delayed by an hour or more. Does anyone know the official bug ID for this within bro-tracker.atlassian.net ? I’ve track…

I can see a number of knobs that could make it happen but I don't know how to go about scripting it. I think it would: - disable logging to manager (done automatically by having a logger node) - bypass the single logger limit - configure each logger to have a writer::kafka - disable other writ…

Do I need to build a custom cluster-layout to do this ? For a proof of concept this is really the only thing that needs to be done. I think broctl has one check to prevent you from configuring two loggers. If that was removed and the code that generates cluster layout was amended to use more th…

Ok. Do you know offhand what file I would look into to make that change ? Also, after creating multiple loggers how would I make each one disable local logging and instead use a kafka export ?

Someone that does this now using the kafka plugin could answer better, but I think it's a matter of using a small script. The kafka plugin comes with a script like this: event bro_init() &priority=-5 { for (stream_id in Log::active_streams) { if (stream_id in Kafka::logs_to_sen…

Thanks. I’ve found the BroControl scripts to modify the logger setup and will be testing soon.

Here’s the problem I’m having so far. I’ve included most of the modified code below. I think I’m using the wrong data type for logger_str_array ? [bro@mgr /opt/bro]$ bin/broctl start starting logger-1 … starting logger-2 … starting logger-3 (was crashed) … starting logger-4 … logger-3 terminat…

Ok I fixed that… loggers[logger_index].name should be used , it’s a reference to the previously defined loggers_str_array[] entries. Now it’s… error in /opt/bro_data/spool/installed-scripts-do-not-touch/auto/cluster-layout.bro, line 22: unknown identifier logger, at or near “logger”

The format string was the problem. The value of logger_str_array[i] would be $logger=“logger-1”. When trying to set it differently the %s was substituted incorrectly and didnt’ have the correct template of $logger=“logger-name”. (My hack needs to be rewritten.) Now it’s fatal error in /opt/bro_data…

I’m using four loggers and the memory usage remains stable. When I re-enable writing logs to disk there’s a difference since logs/current is a symlink to the first logger, spool/logger-1; the other loggers write into their own spool directories (ex: “spool/logger-3”). I think you mentioned this befo…

Bro cluster requirements and manager logging backlog bug

Zeek

Topic		Replies	Views
Logging and memory leak Zeek	10	157	May 6, 2022
Manager swapping.. Zeek	11	160	May 6, 2022
Logger Child Memory Leak (logger crashing often) Zeek	5	170	May 6, 2022
Bro manager dies in a large cluster Zeek	1	131	May 6, 2022
log streams in a bro cluster Zeek	9	172	May 6, 2022

Bro cluster requirements and manager logging backlog bug

Related topics