Re: High Availability with Zeek

Justin Azoff <[email protected]> Fri, 25 Oct 2019 15:04:37 -0400
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAPfnCuhj6+imEV4kAAUureWPwO9-K=EbX=vBsDvWYWZAwdvASA@mail.gmail.com>
On Fri, Oct 25, 2019 at 2:34 PM Jon Siwek <[email protected]> wrote:

> On Wed, Oct 23, 2019 at 8:24 AM Jorge Garcia Rodriguez <[email protected]>
> wrote:
> >
> > So my question here is: ¿Is possible to configure a second Manager or
> something to reach high availability?
>
> The default scripts/configuration more or less depends on there being
> exactly 1 Manager.  That doesn't stop someone from writing their own
> scripts to handle things differently, but while that's technically
> possible, it's not a trivial effort I expect a user undertake.
>
> - Jon
>

We may be a bit further along than people realize though.  With 2.6+ we
have proxy failover, and I think logger failover works too if you configure
more than one.  If the manager dies the most noticeable issues are intel,
notices, and sumstats would stop working..  so I think  only a few places
need updating.  At some point the manager process won't be doing anything.

-- 
Justin

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek