Re: High Availability with Zeek
Justin Azoff <[email protected]> Fri, 25 Oct 2019 15:04:37 -0400
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCuhj6+imEV4kAAUureWPwO9-K=EbX=vBsDvWYWZAwdvASA@mail.gmail.com> |
On Fri, Oct 25, 2019 at 2:34 PM Jon Siwek <[email protected]> wrote: > On Wed, Oct 23, 2019 at 8:24 AM Jorge Garcia Rodriguez <[email protected]> > wrote: > > > > So my question here is: ¿Is possible to configure a second Manager or > something to reach high availability? > > The default scripts/configuration more or less depends on there being > exactly 1 Manager. That doesn't stop someone from writing their own > scripts to handle things differently, but while that's technically > possible, it's not a trivial effort I expect a user undertake. > > - Jon > We may be a bit further along than people realize though. With 2.6+ we have proxy failover, and I think logger failover works too if you configure more than one. If the manager dies the most noticeable issues are intel, notices, and sumstats would stop working.. so I think only a few places need updating. At some point the manager process won't be doing anything. -- Justin _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek