# broctl worker-1 cluster problem

**URL:** <https://community.zeek.org/t/broctl-worker-1-cluster-problem/2799>\
**Category:** Zeek\
**Created:** [August 30, 2013, 1:09am UTC](https://community.zeek.org/t/broctl-worker-1-cluster-problem/2799 "2013-08-30T01:09:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jessebort](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@jessebort](https://community.zeek.org/u/jessebort)\
**Post date:** [August 30, 2013, 1:09am UTC](https://community.zeek.org/t/broctl-worker-1-cluster-problem/2799/1 "2013-08-30T01:09:00Z")

</div>

I’m a new bro user and have tried to find the answer to this, but have had no luck. I’ve got version 2.1 installed. I can run bro in standalone mode with no problem, but I’ve tried to install a bro cluster with worker-1 on a remote host/VM with the same problem. Here is what I’ve tried to do:

created user jesse on both manager/proxy - 192.168.43.1  
o configured node.cfg for manager and proxy to be 192.168.43.1  
o configured node.cfg for worker-1 to be 192.168.43.130  
o performed ssh-keygen as user jesse  
o copied .ssh/rsa\_id.pub to 192.168.43.130 /home/jesse/.ssh/authorized\_keys  
o able to ssh as jesse from 192.168.43.1 to 192.168.43.130 with no required password/passphrase  
o added jesse to /etc/sudoers to do everything root can

created user jesse on worker-1 192.168.43.130 (VM)  
o changed owner of /usr/local/bro to jesse  
o added jesse to /etc/sudoers to do everything root can

as user jesse on manager/proxy \> sudo broctl

[BroControl] \> install  
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/site … done.  
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/auto … done.  
creating policy directories … done.  
installing site policies … done.  
generating cluster-layout.bro … done.  
generating local-networks.bro … done.  
generating broctl-config.bro … done.  
updating nodes … warning: host 192.168.43.130 is not alive \<== Not sure why I got this  
done.  
[BroControl] \> install  
waiting for lock … ok  
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/site … done.  
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/auto … done.  
creating policy directories … done.  
installing site policies … done.  
generating cluster-layout.bro … done.  
generating local-networks.bro … done.  
generating broctl-config.bro … done.  
updating nodes … done. \<== Able to find 192.168.43.130 next time  
[BroControl] \> diag worker-1  
[worker-1]  
No work dir found  
[BroControl] \> start  
starting manager …  
starting proxy-1 …  
starting worker-1 …  
cannot create working directory for worker-1 \<== Issue  
cannot create working directory for [(\<BroControl.node.Node instance at 0x18c14d0\>, ‘/usr/local/bro/spool/worker-1’)] \<== tried to put a debug statement in control.py to see the actual directory it was having issues with

I see nothing installed in /usr/local/bro/spool on worker-1

Thanks for any help you can give me

---

<div class="post-metadata">

**Author:** ![Aashish\_SHARMA2](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Aashish\_SHARMA2](https://community.zeek.org/u/Aashish_SHARMA2)\
**Post date:** [August 30, 2013, 1:31am UTC](https://community.zeek.org/t/broctl-worker-1-cluster-problem/2799/2 "2013-08-30T01:31:35Z")

</div>

I think when manager is installing policies/scripts etc on worker nodes, bro ssh’es to the worker nodes as user “bro” and not as user “jesse”

That’s where you are seeing problem.

Aashish

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/broctl-worker-1-cluster-problem/2799/3 "2022-05-06T15:41:12Z")

</div>