Manager, Proxy and Worker all logging the same notice to notice.log
Denny Sabu <[email protected]> Thu, 26 Dec 2019 20:42:07 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CH2PR11MB42961CA15A1F2364D0E9051EFA2B0@CH2PR11MB4296.namprd11.prod.outlook.com> |
--===============1539767949==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_CH2PR11MB42961CA15A1F2364D0E9051EFA2B0CH2PR11MB4296namp_"
--_000_CH2PR11MB42961CA15A1F2364D0E9051EFA2B0CH2PR11MB4296namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hello,
I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a p=
roxy and 16 workers. In notice.log, I see 3 notices for what appears to be =
a single event. The 3 notices have the same ts, source, destination, IPs, p=
orts, fuids, notes, and msgs but the uid is different for all 3 notices. In=
addition the 'peer_descr' value is different for each, with one being the=
manager, one the proxy and one the worker.
Any help/guidance on the matter would be greatly appreciated.
Best,
Denny Sabu
Software Engineer
Sensato
www.sensato.co<http://www.sensato.co/>
[http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/facebook_sig=
.png]<https://www.facebook.com/SensatoTeam/> [http://cdn2.hubspot.net/hubf=
s/184235/dev_images/signature_app/twitter_sig.png] <https://twitter.com/sen=
satocybersec> [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_=
app/linkedin_sig.png] <https://www.linkedin.com/company/15231342/>
--_000_CH2PR11MB42961CA15A1F2364D0E9051EFA2B0CH2PR11MB4296namp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
Hello,</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a p=
roxy and 16 workers. In notice.log, I see 3 notices for what appears to be =
a single event. The 3 notices have the same ts, source, destination, IPs, p=
orts, fuids, notes, and msgs but
the uid is different for all 3 notices. In addition the 'peer_descr'=
value is different for each, with one being the manager, one the proxy and=
one the worker.</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
Any help/guidance on the matter would be greatly appreciated. <br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
Best,</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id=3D"Signature">
<div></div>
<div></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<span style=3D"color:rgb(243,144,29)">Denny Sabu</span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<span style=3D"color:rgb(0,0,0)"><i>Software Engineer</i></span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<strong>Sensato</strong></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<a href=3D"http://www.sensato.co/" target=3D"_blank" rel=3D"noopener norefe=
rrer" style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-weight:=
normal; font-size:14px; color:rgb(29,161,219)"><span style=3D"font-size:10p=
t; color:rgb(81,167,249); line-height:normal">www.sensato.co</span></a><spa=
n style=3D"color:rgb(81,167,249); font-family:Calibri,Arial,Helvetica,sans-=
serif; font-size:10pt; line-height:normal"> </span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<a href=3D"https://www.facebook.com/SensatoTeam/" target=3D"_blank" rel=3D"=
noopener noreferrer" title=3D"Ctrl+Click or tap to follow the link" sty=
le=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><img =
style=3D"border-style:none; width:25px; height:25px; max-width:25px; max-he=
ight:25px!important" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images=
/signature_app/facebook_sig.png"></a><span style=3D"color:rgb(0,0,0); font-=
family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"> </sp=
an><a href=3D"https://twitter.com/sensatocybersec" target=3D"_blank" rel=3D=
"noopener noreferrer" style=3D"font-family:Calibri,Arial,Helvetica,sans-ser=
if; font-size:12pt"><img style=3D"border-style:none; width:25px; height:25p=
x; max-width:25px; max-height:25px!important" src=3D"http://cdn2.hubspot.ne=
t/hubfs/184235/dev_images/signature_app/twitter_sig.png"></a><span style=3D=
"color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-siz=
e:12pt"> </span><a href=3D"https://www.linkedin.com/company/1523=
1342/" target=3D"_blank" rel=3D"noopener noreferrer" style=3D"font-family:C=
alibri,Arial,Helvetica,sans-serif; font-size:12pt"><img style=3D"border-sty=
le:none; width:25px; height:25px; max-width:25px; max-height:25px!important=
" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/link=
edin_sig.png"></a></div>
</div>
</body>
</html>
--_000_CH2PR11MB42961CA15A1F2364D0E9051EFA2B0CH2PR11MB4296namp_--
--===============1539767949==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1539767949==--