[Bro] Cluster state synchronization

Damian Gerow damian.gerow at shopify.com
Wed Oct 8 09:38:27 PDT 2014

On Wed, Oct 8, 2014 at 12:21 PM, Seth Hall <seth at icir.org> wrote:

> > But I don't see much of a difference between these scripts, as it
> relates to my problem with the timeliness of set updates.  Is there
> anything in particular you've done that might result in sets being updated
> before being referenced for lookups?
> Not really.  You had some code in there that was a little difficult to
> follow which was why I started doing the reorganization and cleanup.  I'm
> wondering if you might have had a bug in there before.  Could you try
> running my updated script and seeing if that works (I wish I had a concrete
> answer, but I don't yet).

Done, and the end result is the same: sets are being updated slowly.  For
one CNAME in question, it took multiple queries and a few minutes for it to
show up in the CNAMEs set.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20141008/535d72dc/attachment.html 

More information about the Bro mailing list