[Bro] Bro workers die

Michal Purzynski michal at rsbac.org
Mon Apr 22 13:04:42 PDT 2013


Hi, me again.

Bro is a new one, from the SVN, but I had the same results with 2.1 stable.

broctl start
starting manager ...
starting proxy ...
starting nsm1-eth4-1 ...
starting nsm1-eth5-1 ...
starting nsm1-eth5-10 ...
starting nsm1-eth5-11 ...
starting nsm1-eth5-12 ...
starting nsm1-eth5-2 ...
starting nsm1-eth5-3 ...
starting nsm1-eth5-4 ...
starting nsm1-eth5-5 ...
starting nsm1-eth5-6 ...
starting nsm1-eth5-7 ...
starting nsm1-eth5-8 ...
starting nsm1-eth5-9 ...
(nsm1-eth5-12 still initializing)
(nsm1-eth5-9 still initializing)
(nsm1-eth5-10 still initializing)
(nsm1-eth5-11 still initializing)
(nsm1-eth4-1 still initializing)

And after a while

Name       Type       Host       Status        Pid    Peers Started
nsm1-eth4-1 worker     <ip> crashed
nsm1-eth5-10 worker     <ip> crashed
nsm1-eth5-11 worker     <ip> crashed
nsm1-eth5-12 worker     <ip> crashed
nsm1-eth5-9 worker     <ip> crashed
manager    manager    <ip> running       44798  9      22 Apr 19:27:37
proxy      proxy      <ip> running       44845  9      22 Apr 19:27:39
nsm1-eth5-1 worker     <ip> running       45048  2      22 Apr 19:27:41
nsm1-eth5-2 worker     <ip> running       45057  2      22 Apr 19:27:41
nsm1-eth5-3 worker     <ip> running       45060  2      22 Apr 19:27:41
nsm1-eth5-4 worker     <ip> running       45063  2      22 Apr 19:27:41
nsm1-eth5-5 worker     <ip> running       45066  2      22 Apr 19:27:41
nsm1-eth5-6 worker     <ip> running       45067  2      22 Apr 19:27:41
nsm1-eth5-7 worker     <ip> running       45068  2      22 Apr 19:27:41
nsm1-eth5-8 worker     <ip> running       45069  2      22 Apr 19:27:41


Two more questions:
1. does Bro use pf_ring by default with a configuration like this?
2. how can i change the load balancing method? I need to spread things 
more evenly.

cat /opt/bro/etc/node.cfg
[manager]
type=manager
host=<ip>

[proxy]
type=proxy
host=<ip>

[nsm1-eth4]
type=worker
host=<ip>
interface=eth4
lb_method=pf_ring
lb_procs=1

[nsm1-eth5]
type=worker
host=<ip>
interface=eth5
lb_method=pf_ring
lb_procs=12




More information about the Bro mailing list