intel framework, disabling certain feeds to certain workers
Munroe Sollog <[email protected]> Wed, 13 Nov 2019 13:55:15 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAN3u96-yFyh9PVTJ1nUAQceDvoNXX84ATJRg62wAKSkT5bKeZw@mail.gmail.com> |
Is there a way to select which intel "files" are sent to particular workers? Perhaps using the aux-script parameter in nodes.cfg? We are running Bro 2.6.4. We are using two remote workers to collect specific data on much smaller machines. On our main cluster we are trying to load a +2GB file using the intel framework. The main cluster seems to handle this file with no problem. However, it is causing the "specialized" remote workers to crash "out of memory". I realize I'm not necessarily using the cluster feature as intended, but it has, thus far, been extremely convenient. I would like to not have to create a separate cluster. Any advice? -- Munroe Sollog Senior Network Engineer [email protected] _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek