[Bro-Dev] Broker data store use case and questions

Jon Siwek jsiwek at corelight.com
Fri May 11 10:34:05 PDT 2018

On 5/11/18 10:15 AM, Michael Dopheide wrote:
> Let me clarify point 4, my goal is just to keep the knownhosts data 
> persistent across restarts.  (Or any data set in the general case.)  So 
> if HRW is the best way to keep data in memory I need a way to write it 
> out to disk on Bro exit so I can read it back in later.

Ok, maybe first try a single data store for persistence (what 
known-hosts will do by default now).

If you then find you overload the centralized manager/master node, my 
next suggestion is to partition the data set across proxies via HRW 
events and combine that with a data store configured for persistence on 
each proxy.

- Jon

More information about the bro-dev mailing list