I’m curious if there is a rough estimate or best practice for the amount of plugins that a bro instance can run without affecting performance?
I have about 5 running so far on a couple instances and all seems good, but not sure if there’s a limit to the number bro can run, if it doesn’t matter, etc.
Just to expand on this a bit - I assume that you are refering to Bro
packages in the package manager.
In this case, there is no clear answer - the packages do vastly different
things with vastly different complexity. If you have a package that adds a
small script that is rarely called, or does a not-expensive operation -
you probably have no problems even loading tens (or hundreds) of them, as
long as they don't conflict.
If the package that you are loading does some expensive
per-packet-processing, even a single one might be too much.
So, the answer is probably - as so often - it depends
Johanna