intel framework, disabling certain feeds to certain workers

Munroe Sollog <[email protected]> Wed, 13 Nov 2019 13:55:15 -0500
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAN3u96-yFyh9PVTJ1nUAQceDvoNXX84ATJRg62wAKSkT5bKeZw@mail.gmail.com>
Is there a way to select which intel "files" are sent to particular
workers?  Perhaps using the aux-script parameter in nodes.cfg?

We are running Bro 2.6.4.  We are using two remote workers to collect
specific data on much smaller machines.  On our main cluster we are trying
to load a +2GB file using the intel framework.  The main cluster seems to
handle this file with no problem.  However, it is causing the "specialized"
remote workers to crash "out of memory".

I realize I'm not necessarily using the cluster feature as intended, but it
has, thus far, been extremely convenient.  I would like to not have to
create a separate cluster.

Any advice?

-- 
Munroe Sollog
Senior Network Engineer
[email protected]

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek