[Bro] Standalone vs. Cluster on a single machine

[Seth Hall]

On Oct 23, 2009, at 9:53 AM, Justin Azoff wrote:

> Are there any benefits or issues with running a bro cluster on a  
> single machine
> instead of in standalone mode?  I'm thinking that running it in  
> cluster mode
> from the start may make it easier to move to a cluster configuration  
> in the
> future, but I'm concerned that it might add unnecessary overhead in  
> the mean
> time.


I would just run in standalone mode.  As far as I know (and Robin will  
know better), the only difference configuration-wise between  
standalone mode and cluster mode is the node.cfg file.  If you run in  
cluster mode when you really only need standalone, you will have the  
overhead of extra bro processes running that aren't really necessary.

I would recommend that you stick to standalone mode for node and if  
you build a cluster eventually, the configuration steps necessary are  
going to be the least of your worries.

   .Seth

---
Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721