[Zeek] intel framework, disabling certain feeds to certain workers

[Jan Grashöfer]

Unfortunately, the short answer is no.

Jan

On 13/11/2019 19:55, Munroe Sollog wrote:
> Is there a way to select which intel "files" are sent to particular 
> workers?  Perhaps using the aux-script parameter in nodes.cfg?
> 
> We are running Bro 2.6.4.  We are using two remote workers to collect 
> specific data on much smaller machines.  On our main cluster we are 
> trying to load a +2GB file using the intel framework.  The main cluster 
> seems to handle this file with no problem.  However, it is causing the 
> "specialized" remote workers to crash "out of memory".
> 
> I realize I'm not necessarily using the cluster feature as intended, but 
> it has, thus far, been extremely convenient.  I would like to not have 
> to create a separate cluster.
> 
> Any advice?
> 
> -- 
> Munroe Sollog
> Senior Network Engineer
> munroe at lehigh.edu <mailto:munroe at lehigh.edu>
> 
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>