[Bro-Dev] clusterization issue: logger node vs manager node or both ?

[Aashish Sharma]

> I *strongly* recommend not running code on the logger.  The whole

I agree and this makes sense. 

> What's the problem you're trying to solve by running code there?

So I have a working clusterized bro package but it stops behaving as expected if I enable logger node. 

I am calling a worker2manager event inside "event log_smtp", that event' isn't kicking at all. When I disable logger, the event runs as expected. So this led me to wonder if somehow log_* events are running on logger and not on worker, which I doubted. 

Further causing concerns about how existence of LOGGER node can affect the entire clusterization architecture. 

Aashish 

On Thu, Jun 01, 2017 at 02:10:47PM -0400, Seth Hall wrote:
> On Thu, Jun 1, 2017 at 1:12 PM, Aashish Sharma <asharma at lbl.gov> wrote:
> 
> > I can surely do "Cluster::local_node_type() == Cluster::LOGGER" and then events logger2manager_events and logger2worker_events etc etc so on so forth.
> 
> I *strongly* recommend not running code on the logger.  The whole
> point of the logger is that it doesn't have any script execution tasks
> to take care of and it's solely dedicated to logging.  What's the
> problem you're trying to solve by running code there?
> 
>   .Seth
> 
> -- 
> Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com