[Bro-Dev] Bro 2.6-beta plans

[Alan Commike]

On Wed, Sep 12, 2018 at 8:21 AM Jon Siwek <jsiwek at corelight.com> wrote:

>
> An idea in this type of situation could be to tune Broker::max_threads
> per node type.  E.g. leave at 1 for workers and bump to ~4 for
> manager/logger since there's idle cores on their host and they're
> inherently in a less-scalable/centralized location.


For those that haven't yet dug into all that is Broker, this brings up a
question on the general architecture. Are there still parent/child
processes handling comms/work?  I'd assume the fork is gone, so the new
code is dropping a process but gaining a thread, in essence a wash.

Is there a mechanism today for per node type tuneables?

   ...alan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20180912/c0d5d61c/attachment.html