[Bro] Running a Bro cluster diskless?

Seth Hall seth at icir.org
Mon Apr 11 13:23:30 PDT 2011


On Apr 11, 2011, at 3:59 PM, Schoenefeld, Keith P. wrote:

> I hope to use the 'manager' server as the master and the worker server as the nodes in a JessWulf cluster to ease configuration and management.  I will certainly have some small local ramdisk as well as local hard drives for non-persistent scratch space as needed.

You will want the local disk space for the directory where you have Bro installed, I usually use /bro on clusters.  The remote.log file is still kept locally on each worker and proxy node and the Bro binary is copied to each when you do the "install" command.  

There is a setting for BroControl named "HaveNFS" which is commented on here:
	http://svn.icir.org/bro/releases/release_1_5/bro/aux/broctl/README.html#_questions_and_answers

> Does anyone have experience running Bro diskless like this already?  What are the common problems unique to this configuration, where will I likely want to leverage the local scratch space, and is this absolutely the wrong way to run a Bro cluster?


OSU ran very similarly to that for a very long time.  I suppose it was actually how the first production cluster (with BroControl at least) was done but we backed away from it a bit due to all of the problems I was encountering.  In the hands of a more experienced cluster admin, I expect the results would be much better. :)

I think you'd probably be fine with this deployment scenario.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/





More information about the Bro mailing list