Re: Two instances of bro on the same host?

--===============0304607207==
Content-Type: multipart/alternative; boundary="0000000000007f8cbf059848d7ed"

--0000000000007f8cbf059848d7ed
Content-Type: text/plain; charset="UTF-8"

Dockorize bro, you can have as many as you want.

On Tue, Nov 26, 2019, 3:05 PM Erich M Nahum <[email protected]> wrote:

> I figured it out.  Two zeek installations (/opt/zeek1, /opt/zeek2), two
> node.cfg files, and most importantly, the second zeekctl.cfg with the port
> changed:
>
> ZeekPort = 48760
>
> instead of the default 47760 port.
>
> I don't know if this is supported, but it seems to work.
>
> -Erich
>
>
> ----- Original message -----
> From: Erich M Nahum/Watson/IBM
> To: [email protected]
> Cc:
> Subject: Two instances of bro on the same host?
> Date: Mon, Nov 25, 2019 2:49 PM
>
> Howdy,
>
> I have a multi-core machine listening to 8 interfaces with zeek.  I'm
> using the kafka plugin to send logs to individual topics (conn, dns, http,
> etc).
>
> I've recently gotten a tap outside the firewall and want to send the
> equivalent logs to different comparable topics (conn-firewall,
> dns-firewall, etc).
>
> I'm currently using zeekctl with multiple workers.  What I'm wondering is
> can I use two instances of zeekctl on the same machine, one for inside the
> FW and one for outside.
>
> It's not an option right now to do the outside the FW on a separate
> machine.
>
> Any suggestions?
>
> Thanks,
>
> -Erich
>
>
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

--0000000000007f8cbf059848d7ed
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Dockorize bro, you can have as many as=C2=A0you want.=C2=
=A0</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_att=
r">On Tue, Nov 26, 2019, 3:05 PM Erich M Nahum &lt;<a href=3D"mailto:nahum@=
us.ibm.com">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"g=
mail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-l=
eft:1ex"><div dir=3D"ltr" style=3D"font-family:Arial,Helvetica,sans-serif;f=
ont-size:10pt"><div dir=3D"ltr">I figured it out.=C2=A0 Two zeek installati=
ons (/opt/zeek1, /opt/zeek2), two node.cfg files, and most importantly, the=
 second zeekctl.cfg with the port changed:</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">ZeekPort =3D 48760</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">instead of the default=C2=A047760 port.</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">I don&#39;t know if this is supported, but it seems to wor=
k.</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">-Erich</div>
<div dir=3D"ltr">=C2=A0</div>
<blockquote dir=3D"ltr" style=3D"border-left:solid #aaaaaa 2px;margin-left:=
5px;padding-left:5px;direction:ltr;margin-right:0px">----- Original message=
 -----<br>From: Erich M Nahum/Watson/IBM<br>To: <a href=3D"mailto:zeek@zeek=
.org" target=3D"_blank" rel=3D"noreferrer">[email protected]</a><br>Cc:<br>Subj=
ect: Two instances of bro on the same host?<br>Date: Mon, Nov 25, 2019 2:49=
 PM<br>=C2=A0
<div dir=3D"ltr" style=3D"font-family:Arial,Helvetica,sans-serif;font-size:=
10pt"><div dir=3D"ltr" style=3D"font-family:Arial,Helvetica,sans-serif;font=
-size:10pt"><div dir=3D"ltr">Howdy,</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">I have a multi-core machine listening to 8 interfaces with=
 zeek.=C2=A0 I&#39;m using the kafka plugin to send logs to individual topi=
cs (conn, dns, http, etc).</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">I&#39;ve recently gotten a tap outside the firewall and wa=
nt to send the equivalent logs=C2=A0to different comparable topics (conn-fi=
rewall, dns-firewall, etc).</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">I&#39;m currently using zeekctl with multiple workers.=C2=
=A0 What I&#39;m wondering is can I use two instances of zeekctl on the sam=
e machine, one for inside the FW and one for outside.</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">It&#39;s not an option right now to do the outside the FW =
on a separate machine.</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">Any suggestions?</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">Thanks,</div>
<div dir=3D"ltr">=C2=A0</div>
<div dir=3D"ltr">-Erich</div></div></div></blockquote>
<div dir=3D"ltr">=C2=A0</div></div><br>

_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"noreferrer">zeek@=
zeek.org</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer noreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/ma=
ilman/listinfo/zeek</a></blockquote></div>

--0000000000007f8cbf059848d7ed--

--===============0304607207==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0304607207==--