Hopefully quick question. How would you go about configuring Bro cluster
nodes to each run dual clients (one per input interface)?
Ie, all of my systems have input sources on eth4 and eth5. Instead of
bonding those together and running a single Bro thread on bond0, I'd
rather have two. Something is getting super confused when I try to do it:
For each worker I have this:
[nids-21a]
type=worker
host=10.142.148.21
interface=eth4
Thanks everyone for the replies and suggestions. Apparently I just forgot
to run 'install' after changing the node config which is embarrassing, but
I still find it interesting that they all reacted differently.
For future reference, all of the instances that fail show:
/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 14
(BroCtl::workers[WORKER]): run-time error, no such index
/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 13
($host=BroCtl::manager$ip, $p=BroCtl::manager$p,
$events=Remote::manager_events, $connect=T, $sync=F, $retry=1.0 min,
$class=BroCtl::workers[WORKER]$tag): run-time error, uninitialized list
value
/usr/local/bro/share/broctl/scripts/run-bro: line 73: 27140 Segmentation
fault (core dumped) nohup $tmpbro $@