[Bro-Dev] Broker has landed in master, please test

[Michael Dopheide]

Do you want dumb programming questions asked here or on the main Bro list?
While most people might not need it yet, discussion there might help get
more people interested or help avoid issues with custom policy conversion.

For here though, can you elaborate on the going down to one proxy?  My
understanding still isn't strong, but that seems to be opposed to the idea
of using Cluster::publish_hrw to spread memory across proxies.

Thanks,
-Dop







On Tue, May 22, 2018 at 9:26 AM, Robin Sommer <robin at icir.org> wrote:

> We merged the new Broker version into Bro master yesterday. As this a
> major change to one of Bro's core components, I wanted to send a quick
> heads-up here, along with a couple of notes.
>
> With this merge we are completely replacing usage of Bro's classic
> communication system with Broker. All the standard scripts have been
> ported over, and BroControl has been adapted as well. The old
> communication system remains available for the time being, but is now
> deprecated and scheduled to be removed in Bro 2.7 (not 2.6). Broccoli
> is now turned off by default.
>
> With such a large change, I'm sure there'll be some more kinks to iron
> out still; that's where we need everybody's help. If you have an
> environment where you can test drive new Bro versions, please give
> this a try. We're interested in any feedback you have, both specific
> issues you encounter (best to file tickets) and general experiences
> with the new version, including in particular any observations about
> performance (best to send to this list).
>
> >From a user's perspective, not much should even be changing, most of
> the new stuff is under the hood. The exception are custom scripts
> doing communication themselves, they need to be ported over to Broker.
> Documentation for that is here:
> https://www.bro.org/sphinx-git/frameworks/broker.html, including a
> porting guide for existing scripts. Let us know if there's anything
> missing there that would be helpful. The Broker library itself comes
> with a new user manual as well, we'll get that online shortly.
>
> One specific note on upgrading existing Bro clusters: the meaning of
> "proxy" has changed. They still exist, but play a quite different role
> now. If you're currently using more than one proxy, we recommend going
> back to one; that'll most likely be fine with the standard scripts
> (and if not, please let us know!)
>
> Many thanks to Jon Siwek for the recent integration work tying up all
> the loose ends and getting Broker mergeable. Also thanks to those who
> have tested it already from the actor-system branch.
>
> Robin
>
> --
> Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin
> _______________________________________________
> bro-dev mailing list
> bro-dev at bro.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20180523/79873e5e/attachment.html