[Bro] Bro Cluster Help
robin at icir.org
Mon Jun 7 10:37:42 PDT 2010
On Fri, Jun 04, 2010 at 16:48 -0500, you wrote:
> I am attempting to figure out how to get a Bro Cluster up and
> running, but all documentation I see is outdated.
The README.html coming with the distribution in aux/broctl is
> First of all, I have the manager and proxy nodes as the main box,
> with two workers being in virtualized OSes. They can all ping each
> other, so I know they are connected. I do not know how to start up
> bro in this method though. Should I be starting bro on the workers,
> then broctl on the manager? Vice Versa? Only start broctl?
I haven't tried such a setup yet but generally it shouldn't make a
difference whether the workers are in VMs or not. Use broctl (only)
on the manager, per the README.
> broctl start script can only be run on a manager node, is there some
> place to tell it this is the manager (it was working before, the
> errors I got were related to the workers, not the manager).
Depending on the version you're using, this patch might or might not
If it is already applied, please delete spool/debug.log, run the
start command again, and then send me the new spool/debug.log.
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro