<div dir="ltr">What is the notice? What does your node.cfg look like?</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Dec 26, 2019 at 3:44 PM Denny Sabu <<a href="mailto:Denny.Sabu@sensato.co">Denny.Sabu@sensato.co</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hello,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a proxy and 16 workers. In notice.log, I see 3 notices for what appears to be a single event. The 3 notices have the same ts, source, destination, IPs, ports, fuids, notes, and msgs but
the uid is different for all 3 notices. In addition the 'peer_descr' value is different for each, with one being the manager, one the proxy and one the worker.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Any help/guidance on the matter would be greatly appreciated. <br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Best,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_-119923988612202668Signature">
<div></div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(243,144,29)">Denny Sabu</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,0,0)"><i>Software Engineer</i></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<strong>Sensato</strong></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<a href="http://www.sensato.co/" rel="noopener noreferrer" style="font-family:Calibri,Arial,Helvetica,sans-serif;font-weight:normal;font-size:14px;color:rgb(29,161,219)" target="_blank"><span style="font-size:10pt;color:rgb(81,167,249);line-height:normal">www.sensato.co</span></a><span style="color:rgb(81,167,249);font-family:Calibri,Arial,Helvetica,sans-serif;font-size:10pt;line-height:normal"> </span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<a href="https://www.facebook.com/SensatoTeam/" rel="noopener noreferrer" title="Ctrl+Click or tap to follow the link" style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt" target="_blank"><img style="border-style: none; width: 25px; height: 25px; max-width: 25px; max-height: 25px;" src="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/facebook_sig.png"></a><span style="color:rgb(0,0,0);font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt"> </span><a href="https://twitter.com/sensatocybersec" rel="noopener noreferrer" style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt" target="_blank"><img style="border-style: none; width: 25px; height: 25px; max-width: 25px; max-height: 25px;" src="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/twitter_sig.png"></a><span style="color:rgb(0,0,0);font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt"> </span><a href="https://www.linkedin.com/company/15231342/" rel="noopener noreferrer" style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt" target="_blank"><img style="border-style: none; width: 25px; height: 25px; max-width: 25px; max-height: 25px;" src="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/linkedin_sig.png"></a></div>
</div>
</div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Justin</div></div>