Re: Two instances of bro on the same host?

I figured it out. Two zeek installations (/opt/zeek1, /opt/zeek2), two node.cfg files, and most importantly, the second zeekctl.cfg with the port changed:

ZeekPort = 48760

instead of the default 47760 port.

I don't know if this is supported, but it seems to work.

-Erich

----- Original message -----
From: Erich M Nahum/Watson/IBM
To: [email protected]
Cc:
Subject: Two instances of bro on the same host?
Date: Mon, Nov 25, 2019 2:49 PM

Howdy,

I have a multi-core machine listening to 8 interfaces with zeek. I'm using the kafka plugin to send logs to individual topics (conn, dns, http, etc).

I've recently gotten a tap outside the firewall and want to send the equivalent logs to different comparable topics (conn-firewall, dns-firewall, etc).

I'm currently using zeekctl with multiple workers. What I'm wondering is can I use two instances of zeekctl on the same machine, one for inside the FW and one for outside.

It's not an option right now to do the outside the FW on a separate machine.

Any suggestions?

Thanks,

-Erich

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek