Use zeek scripts only with the "manager" in a cluster configuration

Development
1

Hi, I have abnormal behavior when I use the same script in two different configurations:

  1. Zeek single thread configuration
  2. Zeek configuration with four cores and four workers.

By starting the script in question, in the first mode (zeek on a single thread) the flow
execution is linear with respect to the code, so the instructions are executed without any
Abnormal behavior.

By starting the script in question, with the second modality (zeek multithread with four cores and four workers)
the code is started correctly, but at some point workers are seen to be performing actions
randomly.

Is it possible to inhibit the use of code fragments for workers?
Zeek scripts can only be used by Zeek’s “manager” or “logger”,
so as to prevent “workers” from doing unwanted actions? If yes, is also possible to make “worker”
able to use some code fragments instead of others ?

2

See if these examples help:
https://docs.zeek.org/en/current/frameworks/broker.html#cluster-framework-examples

This particular one shows 3 different way to conditionalize the
execution of code based on either the node type or a specific node's
name: https://docs.zeek.org/en/current/frameworks/broker.html#manager-sending-events-to-workers

- Jon

3

Awesome, thanks!