[Bro] Standalone vs. Cluster on a single machine

Robin Sommer robin at icir.org
Fri Oct 23 10:44:32 PDT 2009

On Fri, Oct 23, 2009 at 10:59 -0400, Seth Hall wrote:

> I would just run in standalone mode.  As far as I know (and Robin will  
> know better), the only difference configuration-wise between  
> standalone mode and cluster mode is the node.cfg file. 

That's right, once it's running. During the initial installation,
there's one more difference: the standalone puts the various *.cfg
files in place, while the cluster installation only installs
templates which one then has to copy to the right place oneself
(because they need more editing). 

I would also recommend using the stand-alone mode as long as you
don't want to try leveraging multiple cores in your box by running
multiple processes. 


Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list