[Zeek] Bro 2.6.1 packet loss

Seth Hall seth at corelight.com
Thu Jan 24 06:37:25 PST 2019



On 23 Jan 2019, at 13:03, COLIN BLAIR wrote:

> [worker-1]
> localhost
> lb_method = pf_ring
> lb_procs = 20
> pin_cpus = 0-19

Is this your actual configuration?  I don't even see an interface to 
sniff, and where you've specified "localhost" seems to not have the 
associated configuration key.

Based on your question about pf_ring too, it sounsd like you might not 
actually be load balancing your traffic.  Are you having duplicate logs?

   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com


More information about the Zeek mailing list