[Bro] multiple workers per cluster node

[Justin Azoff]

On Fri, Mar 04, 2011 at 05:29:40PM -0500, Dop wrote:
> Hopefully quick question.  How would you go about configuring Bro cluster
> nodes to each run dual clients (one per input interface)?
> ...
> What's strange is that it seems to fail unevenly.  Fails totally on 21,
> partially on 22 and 23, but works on 24.  It's always the same nodes
> failing.

This should work fine,  I run 4 workers on one machine without any
issues.

It sounds like maybe you have some filesystem issues preventing bro from
starting.

What do you have in /usr/local/bro/spool/ for each of the failing nodes?
Is there anything in the stdout or stderr logs?

/usr/local/bro/spool/debug.log may also have useful info

I would focus on the machine that it starts partially on.

-- 
-- Justin Azoff
-- Network Security & Performance Analyst