[Bro] Issue with Bro reporting dropped packets

Seth Hall seth at corelight.com
Fri Mar 3 05:50:35 PST 2017


> On Mar 2, 2017, at 6:26 PM, Espresso Beanies <espressobeanies at gmail.com> wrote:
> 
> I definitely did. I tried asking earlier if there was a difference between adding more Bro workers via [worker-1],[worker-2],[worker-3],etc... vs lb_procs 'N' but didn't receive a response. I tried both methods in the node.cfg file with little to no noticeable performance impact. I'm definitely using CPU affinity.

There is no difference.  The whole lb_procs thing arose because we used to have people with huge node.cfg files because they were running a lot of workers.  Adding the lb_procs mechanism gave them a short hand to not have to configure each and every worker.

  .Seth

--
Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com




More information about the Bro mailing list