[Bro] Bro Cluster Help

[Robin Sommer]

On Fri, Jun 04, 2010 at 16:48 -0500, you wrote:

> I am attempting to figure out how to get a Bro Cluster up and
> running, but all documentation I see is outdated.

The README.html coming with the distribution in aux/broctl is
current:

    http://svn.icir.org/bro/trunk/bro/aux/broctl/README.html
    
> First of all, I have the manager and proxy nodes as the main box,
> with two workers being in virtualized OSes. They can all ping each
> other, so I know they are connected. I do not know how to start up
> bro in this method though. Should I be starting bro on the workers,
> then broctl on the manager? Vice Versa? Only start broctl?

I haven't tried such a setup yet but generally it shouldn't make a
difference whether the workers are in VMs or not. Use broctl (only)
on the manager, per the README. 

> broctl start script can only be run on a manager node, is there some
> place to tell it this is the manager (it was working before, the
> errors I got were related to the workers, not the manager).

Depending on the version you're using, this patch might or might not
be applied:

     http://tracker.icir.org/bro/attachment/ticket/190/is-local-manager.patch.txt

If it is already applied, please delete spool/debug.log, run the
start command again, and then send me the new spool/debug.log.

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org