Re: intel framework, disabling certain feeds to certain workers
Jan Grashöfer <[email protected]> Wed, 13 Nov 2019 20:06:37 +0100
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Unfortunately, the short answer is no. Jan On 13/11/2019 19:55, Munroe Sollog wrote: > Is there a way to select which intel "files" are sent to particular > workers? Perhaps using the aux-script parameter in nodes.cfg? > > We are running Bro 2.6.4. We are using two remote workers to collect > specific data on much smaller machines. On our main cluster we are > trying to load a +2GB file using the intel framework. The main cluster > seems to handle this file with no problem. However, it is causing the > "specialized" remote workers to crash "out of memory". > > I realize I'm not necessarily using the cluster feature as intended, but > it has, thus far, been extremely convenient. I would like to not have > to create a separate cluster. > > Any advice? > > -- > Munroe Sollog > Senior Network Engineer > [email protected] <mailto:[email protected]> > > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek