[Bro] Issue with Bro reporting dropped packets
espressobeanies at gmail.com
Fri Mar 3 08:26:07 PST 2017
That makes more sense. Thank you for the background. I was able to find and
resolve the issue I was experiencing with ntop. Thank you both.
On Fri, Mar 3, 2017 at 8:50 AM, Seth Hall <seth at corelight.com> wrote:
> > On Mar 2, 2017, at 6:26 PM, Espresso Beanies <espressobeanies at gmail.com>
> > I definitely did. I tried asking earlier if there was a difference
> between adding more Bro workers via [worker-1],[worker-2],[worker-3],etc...
> vs lb_procs 'N' but didn't receive a response. I tried both methods in the
> node.cfg file with little to no noticeable performance impact. I'm
> definitely using CPU affinity.
> There is no difference. The whole lb_procs thing arose because we used to
> have people with huge node.cfg files because they were running a lot of
> workers. Adding the lb_procs mechanism gave them a short hand to not have
> to configure each and every worker.
> Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro