Thanks guys, that helps. Robin I'll take a look at the cluster, looks like you have a standalone config in there, so that will have to do for the time being - won't be getting any new boxes in the immediate future to make a real cluster.<br>
<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d"><br>
</div>Try "bro -t tracefile ..." to generate an execution trace. When no output<br>
gets produced, usually the problem is that no events are being generated<br>
because the event engine isn't finding that you've defined the event<br>
handlers it expects for turning on different forms of application analysis.<br>
If the trace shows that the events are being generated, then annotating<br>
your script with logging information will usually help zero in on the<br>
problem quickly.<br>
<font color="#888888"><br></font></blockquote></div><br>Fair enough, I'll give that a try. I liked the idea of the debugger because you could run through a fairly large pcap and fix most of the problems in one go rather than many repeated analysis runs. This way I'll have to carve out a much smaller pcap that has the traffic to generate the needed events. <br>
<br>If I can't get any further along like this I'll move the config over and send it to the list.<br><br>Thanks for the quick replies!<br><br>Cheers,<br>Greg<br>