Question log/spool directory specification in broctl.conf

Zeek
1

I am running multiple bro workers in the same CPU, and would like to create different log and spool directories for each worker to avoid conflicts. Is there a worker specific meta variable I could use in the broctl.cfg file so that when broctl creates log and spool directories, it uses different file names for different workers?

Alternatively, is there a way for all of the workers to use the same log and spool directories without conflicts? Currently, if I do that, I see workers crashing.

Thanks,

Raj

2

Broctl automatically creates a separate working directory (such as
"spool/worker-1") for each Bro process. All of the logs are
automatically sent to the manager.

3

Thank you, Daniel. I did see the directories for different workers, so my question was more or less a shot in the dark. I will look some more into the worker crashes I have seen, and get back if I need any help.

Thanks again!
Raj