[Zeek-Dev] Use zeek scripts only with the "manager" in a cluster configuration

Davide Robusto daviderobusto at gmail.com
Wed Jun 10 08:06:57 PDT 2020


Hi, I have abnormal behavior when I use the same script in two different
configurations:
1. Zeek single thread configuration
2. Zeek configuration with four cores and four workers.

By starting the script in question, in the first mode (zeek on a single
thread) the flow
execution is linear with respect to the code, so the instructions are
executed without any
Abnormal behavior.

By starting the script in question, with the second modality (zeek
multithread with four cores and four workers)
the code is started correctly, but at some point workers are seen to be
performing actions
randomly.

Is it possible to inhibit the use of code fragments for workers?
Zeek scripts can only be used by Zeek's "manager" or "logger",
so as to prevent "workers" from doing unwanted actions? If yes, is also
possible to make "worker"
able to use some code fragments instead of others ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/zeek-dev/attachments/20200610/87cd8794/attachment.html 


More information about the Zeek-Dev mailing list