I got a question today about how to figure out which worker is seeing connections in a large cluster so I whipped up some code quickly to help find out. I'm including it here because I think it may help others too.
====begin=====
redef record Conn::Info += {
peer: string &log &optional;
};
event connection_state_remove(c: connection)
{
if ( c?$conn )
c$conn$peer = peer_description;
}
====end=====
That will include a "peer" column in your conn.log that indicates which worker analyzed the connection. You should probably include this code in a new file in your site/ directory and load the file in local.bro. Since the file is in your site/ directory you won't need to add any directory prefixes and you can load the file directly. If you place the file into <prefix>/share/bro/site/conn-peer-extension.bro you can load it in local.bro with "@load conn-peer-extension".
.Seth