Re: Manager, Proxy and Worker all logging the same notice to notice.log

--===============0444737032==
Content-Type: multipart/alternative; boundary="000000000000841571059aa28898"

--000000000000841571059aa28898
Content-Type: text/plain; charset="UTF-8"

What is the notice?  What does your node.cfg look like?

On Thu, Dec 26, 2019 at 3:44 PM Denny Sabu <[email protected]> wrote:

> Hello,
>
> I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a
> proxy and 16 workers. In notice.log, I see 3 notices for what appears to be
> a single event. The 3 notices have the same ts, source, destination, IPs,
> ports, fuids, notes, and msgs but the uid is different for all 3 notices.
> In addition the  'peer_descr' value is different for each, with one being
> the manager, one the proxy and one the worker.
>
> Any help/guidance on the matter would be greatly appreciated.
>
> Best,
>
> Denny Sabu
> *Software Engineer*
> *Sensato*
> www.sensato.co
> <https://www.facebook.com/SensatoTeam/>
> <https://twitter.com/sensatocybersec>
> <https://www.linkedin.com/company/15231342/>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



-- 
Justin

--000000000000841571059aa28898
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">What is the notice?=C2=A0 What does your node.cfg look lik=
e?</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr=
">On Thu, Dec 26, 2019 at 3:44 PM Denny Sabu &lt;<a href=3D"mailto:Denny.Sa=
[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">




<div dir=3D"ltr">
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
Hello,</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
I have a clustered deployment of Zeek (v3.0.0) consisting of a manager, a p=
roxy and 16 workers. In notice.log, I see 3 notices for what appears to be =
a single event. The 3 notices have the same ts, source, destination, IPs, p=
orts, fuids, notes, and msgs but
 the uid is different for all 3 notices. In addition the=C2=A0 &#39;peer_de=
scr&#39; value is different for each, with one being the manager, one the p=
roxy and one the worker.</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
Any help/guidance on the matter would be greatly appreciated. <br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
Best,</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<br>
</div>
<div id=3D"gmail-m_-119923988612202668Signature">
<div></div>
<div></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<span style=3D"color:rgb(243,144,29)">Denny Sabu</span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<span style=3D"color:rgb(0,0,0)"><i>Software Engineer</i></span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<strong>Sensato</strong></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<a href=3D"http://www.sensato.co/" rel=3D"noopener noreferrer" style=3D"fon=
t-family:Calibri,Arial,Helvetica,sans-serif;font-weight:normal;font-size:14=
px;color:rgb(29,161,219)" target=3D"_blank"><span style=3D"font-size:10pt;c=
olor:rgb(81,167,249);line-height:normal">www.sensato.co</span></a><span sty=
le=3D"color:rgb(81,167,249);font-family:Calibri,Arial,Helvetica,sans-serif;=
font-size:10pt;line-height:normal">=C2=A0=C2=A0</span></div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt=
;color:rgb(0,0,0)">
<a href=3D"https://www.facebook.com/SensatoTeam/" rel=3D"noopener noreferre=
r" title=3D"Ctrl+Click or tap to follow the link" style=3D"font-family:Cali=
bri,Arial,Helvetica,sans-serif;font-size:12pt" target=3D"_blank"><img style=
=3D"border-style: none; width: 25px; height: 25px; max-width: 25px; max-hei=
ght: 25px;" src=3D"http://cdn2.hubspot.net/hubfs/184235/dev_images/signatur=
e_app/facebook_sig.png"></a><span style=3D"color:rgb(0,0,0);font-family:Cal=
ibri,Arial,Helvetica,sans-serif;font-size:12pt">=C2=A0=C2=A0</span><a href=
=3D"https://twitter.com/sensatocybersec" rel=3D"noopener noreferrer" style=
=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt" target=
=3D"_blank"><img style=3D"border-style: none; width: 25px; height: 25px; ma=
x-width: 25px; max-height: 25px;" src=3D"http://cdn2.hubspot.net/hubfs/1842=
35/dev_images/signature_app/twitter_sig.png"></a><span style=3D"color:rgb(0=
,0,0);font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt">=C2=A0=
=C2=A0</span><a href=3D"https://www.linkedin.com/company/15231342/" rel=3D"=
noopener noreferrer" style=3D"font-family:Calibri,Arial,Helvetica,sans-seri=
f;font-size:12pt" target=3D"_blank"><img style=3D"border-style: none; width=
: 25px; height: 25px; max-width: 25px; max-height: 25px;" src=3D"http://cdn=
2.hubspot.net/hubfs/184235/dev_images/signature_app/linkedin_sig.png"></a><=
/div>
</div>
</div>

_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div=
 dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Justin</div></div>

--000000000000841571059aa28898--

--===============0444737032==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0444737032==--