Re: Request for Feedback - Zeek Process Supervision Model
James Lay <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
High resource usage of broctrl prevents me from running it at home...so hopefully that can be improved upon. James On 2019-03-19 09:31, Zander Work wrote: > This would be awesome to have, especially in a cluster environment. > Testing new scripts before we push them to production is a bit > challenging sometimes, so being able to reliably and repeatably test > them in a clustered environment would be awesome. > Another thing that wasn't mentioned in the blog post that I want to > make sure makes it into the new process is something like "broctl > cron". It does a great job of restarting processes when they crash, > but also monitoring disk usage and other potential issues for us, > which is helpful in ensuring the stability of our cluster. I see the > "revive zombie nodes" piece in the Google Doc, which covers the first > bit, but other host-level monitoring/alerting components would be nice > to see in the new process. > > -Zander > > On 3/18/19 6:55 PM, anthony kasza wrote: > > I'm excited to see this. I think it's a great design choice. This > sentence is my favorite, "We need to make it easy to test, from the > command-line, using just PCAP files, a complete cluster deployment > (scaled down) as it would work in production." > > I'm looking forward to it! > > -AK > > On Mon, Mar 18, 2019, 19:44 Jon Siwek <[email protected]> wrote: > > I just published some design thoughts related to a major new Zeek > feature that's planned/upcoming: a process supervision model that > may > act as an alternative (successor) to BroControl. Find that here: > > https://blog.zeek.org/2019/03/beyond-brocontrol-new-process.html > > Feel free to use this mailing list / thread to provide feedback, > thanks. > > - Jon > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek