# "broctl cron" running every 5 mins, and side effects

**URL:** <https://community.zeek.org/t/broctl-cron-running-every-5-mins-and-side-effects/4323>\
**Category:** Zeek\
**Created:** [September 2, 2016, 1:35pm UTC](https://community.zeek.org/t/broctl-cron-running-every-5-mins-and-side-effects/4323 "2016-09-02T13:35:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Glenn.Larratt](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Glenn.Larratt](https://community.zeek.org/u/Glenn.Larratt)\
**Post date:** [September 2, 2016, 1:35pm UTC](https://community.zeek.org/t/broctl-cron-running-every-5-mins-and-side-effects/4323/1 "2016-09-02T13:35:55Z")

</div>

Can anyone comment on what "broctl cron" is actually doing?

My DNS admin reported to me that, at 5-minute intervals, my six bro hosts (1x manager+proxy, 5 workers) are spewing DNS queries in the thousands,  
all forward and reverse lookups of themselves and each other (sample appended). It \*seems\* to be correlated in time with the running of "broctl cron".

Thanks for any info,

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [September 3, 2016, 4:00pm UTC](https://community.zeek.org/t/broctl-cron-running-every-5-mins-and-side-effects/4323/2 "2016-09-03T16:00:25Z")

</div>

broctl cron primarily checks up on the workers via ssh.

Are you using a bro version earlier than 2.4 ? 2.4 will make one connection per worker box, before that it made one connection for each worker process.

What you are seeing looks like bro \< 2.4 plus ssh having UseDns or VerifyReverseMapping enabled.

It's also interesting that bro01 is not one of the names in the output, and bro05 appears 5% as often as 2,3,4 are.

In general you should be running a local caching resolver (unbound,dnsmasq,etc). Things run better across the board when you are caching dns responses locally and not going out to the network for every lookup.

---

<div class="post-metadata">

**Author:** ![Glenn.Larratt](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Glenn.Larratt](https://community.zeek.org/u/Glenn.Larratt)\
**Post date:** [September 14, 2016, 1:07pm UTC](https://community.zeek.org/t/broctl-cron-running-every-5-mins-and-side-effects/4323/3 "2016-09-14T13:07:46Z")

</div>

Thanks!

At the recommendation of my sysadmins, I installed a caching nameserver directly on my manager host - problem solved (for that host).

I haven't decided yet whether the workers should use the nameserver on the manager, or each one should run his own, but I think that'll fix things.

&nbsp;&nbsp;&nbsp;-g

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/broctl-cron-running-every-5-mins-and-side-effects/4323/4 "2022-05-06T15:43:59Z")

</div>