[Zeek] Request for Feedback - Zeek Process Supervision Model

[Seth Hall]

On 20 Mar 2019, at 3:49, Michał Purzyński wrote:

> I have only one request so far, still reading the proposal. Can we 
> make
> sure that we support a configuration where in a stable state (after
> initialization has been done) there is only one worker process per 
> core,
> without all those run-bro scripts and the like?

All of that optimization should be possible.  It wasn't included in the 
proposal because it should be possible to build on top of whatever this 
ends up looking like in the end and I don't think any of us quite know 
what that actual config would look like.  If you have some suggestions 
about how the configuration should look or work or even thoughts about 
the mechanism it should use feel free to speak up. :)

   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com