cluster VS single instance - different results

Zeek
1

Hi all,

I know issues related to this exists out there, but I havent manage to fix it yet…

The issue is that a single bro instance produces relevant logs upon listening to interface eth0.

Yet broctl configured with a single worker that is listening to the same interface, running the same scripts, fail to produce relevant log files.

I tried setting ignore_checksum = T and I have tried to run bro worker the way broctl runs it.

Can anyone think of an explanation for this issue ?

Both single instance and single worker have the same additional scripts…

Thanks alot

B

2

The issue is that a single bro instance produces relevant logs upon listening to interface eth0.

Yet broctl configured with a single worker that is listening to the same interface, running the same scripts, fail to produce relevant log files.

Hm, I’m not sure what could be causing that. Could you show the output of “ps auwwxf” while you have it running with broctl?

.Seth