<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a proxy and 16 workers. In notice.log, I see 3 notices for what appears to be a single event. The 3 notices have the same ts, source, destination, IPs, ports, fuids, notes, and msgs but
the uid is different for all 3 notices. In addition the 'peer_descr' value is different for each, with one being the manager, one the proxy and one the worker.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Any help/guidance on the matter would be greatly appreciated. <br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div></div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color:rgb(243,144,29)">Denny Sabu</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0)"><i>Software Engineer</i></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<strong>Sensato</strong></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<a href="http://www.sensato.co/" target="_blank" rel="noopener noreferrer" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-weight:normal; font-size:14px; color:rgb(29,161,219)"><span style="font-size:10pt; color:rgb(81,167,249); line-height:normal">www.sensato.co</span></a><span style="color:rgb(81,167,249); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:10pt; line-height:normal"> </span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<a href="https://www.facebook.com/SensatoTeam/" target="_blank" rel="noopener noreferrer" title="Ctrl+Click or tap to follow the link" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img style="border-style:none; width:25px; height:25px; max-width:25px; max-height:25px!important" src="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/facebook_sig.png"></a><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"> </span><a href="https://twitter.com/sensatocybersec" target="_blank" rel="noopener noreferrer" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img style="border-style:none; width:25px; height:25px; max-width:25px; max-height:25px!important" src="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/twitter_sig.png"></a><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"> </span><a href="https://www.linkedin.com/company/15231342/" target="_blank" rel="noopener noreferrer" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img style="border-style:none; width:25px; height:25px; max-width:25px; max-height:25px!important" src="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/linkedin_sig.png"></a></div>
</div>
</body>
</html>