[Bro] Problems in Communicating with BroCluster Using Broccoli

[赵芮元]

Hi all,
Sorry to trouble! Now I encountered a problem when I tries to implement a programme that is capable of communicating with Bro CLuster. The programme functions well when communicating with single Bro, but has problem when I installed the scripts to BroCluster.
The Bro-end is something like:


@load frameworks/communication/listen
redef Communication::listen_port = 49889/tcp; 
redef Communication::listen_ssl = F;
global ping_log = open_log_file("alert");
global alert: event(t: string, id: string, sip: string, sp: string, dip: string, dp: string); 
 redef Communication::nodes += { ["pingevent"] = [$host = 202.197.165.213, $events = /alert/, $connect=T, $ssl=F] };
 event alert(t: string, id: string, sip: string, sp: string, dip: string, dp: string) 
{
 print ping_log, fmt("Alert received, %s",id);
 print fmt("alert event recieved! %s %s %s %s %s %s",t,id,sip,sp,dip,dp); }
}
 And the other end sends Bro events to the Bro-end.
Now, the problem is while this script works well when communicating with single Bro which uses the command "bro", but it has problems when I install them to the Bro Cluster nodes, e.g. local-manager.bro or local-worker.bro. My script and programme is  listed in the attachment. Hope for help!! Thanks a lot!


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140426/a63583e8/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: local-worker.bro
Type: application/octet-stream
Size: 750 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140426/a63583e8/attachment.obj 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: pingevent.c
Url: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140426/a63583e8/attachment.c