[Bro] Question about Bro manager write data to kafka

[Azoff, Justin S]

> On Jun 13, 2017, at 9:09 AM, Alkene Pan <alkenepan at gmail.com> wrote:
> 
> Hi Bro, i'm encountered a performance issue about Bro manager write data to kafka. Can anyone help me please?
...
> 
> Bro Cluster Config details:
> [manager]
> type=manager
> host=localhost
> 
> [proxy-1]
> type=proxy
> host=localhost
> 
> [worker-1]
> type=worker
> host=localhost
> interface=eno1
> aux_scripts= -C
> lb_method=pf_ring
> lb_procs=15
> pin_cpus=3,5,7,9,11,13,15,17,19,21,23,25,27,29,31
> 
...

> The mechanism is correct? Or Bro Manager exist performance issue about write a huge data into Kafka? Or incorrect configuration? Please kindly let me know if you have any recommendation. Thank you so much.

You're not running a logger process which will easily double the performance of your cluster.  Add

[logger]
type=logger
host=localhost

to your node.cfg

If you install the bro 2.5.1 beta you can have two or more loggers defined:


[logger-1]
type=logger
host=localhost

[logger-2]
type=logger
host=localhost

(This is specifically intended for things like kafka)

-- 
- Justin Azoff