[Bro-Dev] Broker cluster discovery and load balancing

Jon Siwek jsiwek at corelight.com
Thu Dec 6 12:50:50 PST 2018

On Thu, Dec 6, 2018 at 11:16 AM Hosom, Stephen M <hosom at battelle.org> wrote:

> I have looked at the implementations of publish_hrw and publish_rr in bro. I could easily implement those features in my application if that is the recommended way to handle this issue.

There's been some ideas on pushing loading balancing mechanisms into
broker itself, but I doubt that's something that will get done in the
near term.  Explicitly implementing HRW or Round-Robin load balancing
in your application is definitely one way to handle things for now.

> Unfortunately, that leaves me with another unfortunate problem. I have been unsuccessful in determining how to 'discover' members of a Bro cluster via Broker. Is there a way to do discovery, or do I need to know who the cluster members are and what port they are listening on via a broctl configuration equivalent?

At the moment, the cluster configuration is defined by the
Cluster::nodes table that gets auto-generated by broctl into
cluster-layout.bro.  Does that table have all the info you need?

You still might need a well-known node to connect your broker
application (e.g. manager) to, but then you should be able to send
back the information you need from that table (e.g. here's the list of
worker ip/port pairs).

- Jon

More information about the bro-dev mailing list