Yeah, I think my problem was just overlap, but I feel we should keep a list of these kinds of things to look out for in the transition. For instance, remembering to remove cron jobs that run as the ‘bro’ user when that user no longer exists. We’ve also got systems where /usr/local/bro/logs is a separate filesystem.
-Dop