# Duplicate log entries for events

**URL:** <https://community.zeek.org/t/duplicate-log-entries-for-events/2853>\
**Category:** Zeek\
**Created:** [October 8, 2013, 9:16pm UTC](https://community.zeek.org/t/duplicate-log-entries-for-events/2853 "2013-10-08T21:16:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brendan\_Dalpe](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@Brendan\_Dalpe](https://community.zeek.org/u/Brendan_Dalpe)\
**Post date:** [October 8, 2013, 9:16pm UTC](https://community.zeek.org/t/duplicate-log-entries-for-events/2853/1 "2013-10-08T21:16:11Z")

</div>

I’m running into an issue where I’m seeing multiple entries in my logs for a single event which is duplicated 4 times. The entries are all identical except for the UID. I’m running 4 worker processes on the server monitoring one interface.

node.cfg:

[manager]  
type=manager  
host=10.1.26.22

[proxy]  
type=proxy  
host=10.1.26.22

[bro-eth0]  
type=worker  
host=10.1.26.22  
interface=eth0  
lb\_method=pf\_ring  
lb\_procs=4

Any thoughts?

Thanks in advance,

Brendan

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [October 9, 2013, 4:35pm UTC](https://community.zeek.org/t/duplicate-log-entries-for-events/2853/2 "2013-10-09T16:35:00Z")

</div>

It sounds like something isn't installed correctly. Did you successfully build Bro against the pf\_ring libpcap wrapper? Your traffic isn't load balancing and each worker is getting the full stream.

Maybe you could show us your configure command? You can see exactly what you did if you go to your source and look at build/config.status

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Alex\_Waher](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@Alex\_Waher](https://community.zeek.org/u/Alex_Waher)\
**Post date:** [October 9, 2013, 7:50pm UTC](https://community.zeek.org/t/duplicate-log-entries-for-events/2853/3 "2013-10-09T19:50:26Z")

</div>

Make sure `lsmod` shows that the pf\_ring module is loaded. If its not loaded, `modprobe pf_ring`  
Or verify the eth0 interface is running with pf\_ring by checking /proc/net/pf\_ring/dev/eth0/info

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/duplicate-log-entries-for-events/2853/4 "2022-05-06T15:41:18Z")

</div>