Bro plugins: Any best practices for the number of plugins on an instance?

I’m curious if there is a rough estimate or best practice for the amount of plugins that a bro instance can run without affecting performance?

I have about 5 running so far on a couple instances and all seems good, but not sure if there’s a limit to the number bro can run, if it doesn’t matter, etc.

Thanks in advance.

When you say plugins, what exactly are you referring to?

Just to expand on this a bit - I assume that you are refering to Bro
packages in the package manager.

In this case, there is no clear answer - the packages do vastly different
things with vastly different complexity. If you have a package that adds a
small script that is rarely called, or does a not-expensive operation -
you probably have no problems even loading tens (or hundreds) of them, as
long as they don't conflict.

If the package that you are loading does some expensive
per-packet-processing, even a single one might be too much.

So, the answer is probably - as so often - it depends :slight_smile: