[Bro] Issue with Bro reporting dropped packets
Seth Hall
seth at corelight.com
Fri Mar 3 05:50:35 PST 2017
> On Mar 2, 2017, at 6:26 PM, Espresso Beanies <espressobeanies at gmail.com> wrote:
>
> I definitely did. I tried asking earlier if there was a difference between adding more Bro workers via [worker-1],[worker-2],[worker-3],etc... vs lb_procs 'N' but didn't receive a response. I tried both methods in the node.cfg file with little to no noticeable performance impact. I'm definitely using CPU affinity.
There is no difference. The whole lb_procs thing arose because we used to have people with huge node.cfg files because they were running a lot of workers. Adding the lb_procs mechanism gave them a short hand to not have to configure each and every worker.
.Seth
--
Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com
More information about the Bro
mailing list