[Bro] Cluster state synchronization

[Seth Hall]

On Oct 8, 2014, at 12:38 PM, Damian Gerow <damian.gerow at shopify.com> wrote:

> Done, and the end result is the same: sets are being updated slowly.  For one CNAME in question, it took multiple queries and a few minutes for it to show up in the CNAMEs set.

Weird.  Could you try removing the &persistent attribute from those variables with it set?  That attribute hasn't been used much ever, especially in the past couple of years.  It's probably going to be removed before too many more releases too (replaced by something else).

It would help if you had some traffic that showed this effect too.  It possible that there is something weird going on with your traffic that is giving this appearance.

  .Seth


--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/