[Bro-Dev] Bro 2.6-beta plans
commike at reservoir.com
Wed Sep 12 09:57:52 PDT 2018
On Wed, Sep 12, 2018 at 8:21 AM Jon Siwek <jsiwek at corelight.com> wrote:
> An idea in this type of situation could be to tune Broker::max_threads
> per node type. E.g. leave at 1 for workers and bump to ~4 for
> manager/logger since there's idle cores on their host and they're
> inherently in a less-scalable/centralized location.
For those that haven't yet dug into all that is Broker, this brings up a
question on the general architecture. Are there still parent/child
processes handling comms/work? I'd assume the fork is gone, so the new
code is dropping a process but gaining a thread, in essence a wash.
Is there a mechanism today for per node type tuneables?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the bro-dev