Do you want dumb programming questions asked here or on the main Bro list?
While most people might not need it yet, discussion there might help get
more people interested or help avoid issues with custom policy conversion.
For here though, can you elaborate on the going down to one proxy? My
understanding still isn't strong, but that seems to be opposed to the idea
of using Cluster::publish_hrw to spread memory across proxies.
On Tue, May 22, 2018 at 9:26 AM, Robin Sommer <robin(a)icir.org> wrote:
We merged the new Broker version into Bro master
yesterday. As this a
major change to one of Bro's core components, I wanted to send a quick
heads-up here, along with a couple of notes.
With this merge we are completely replacing usage of Bro's classic
communication system with Broker. All the standard scripts have been
ported over, and BroControl has been adapted as well. The old
communication system remains available for the time being, but is now
deprecated and scheduled to be removed in Bro 2.7 (not 2.6). Broccoli
is now turned off by default.
With such a large change, I'm sure there'll be some more kinks to iron
out still; that's where we need everybody's help. If you have an
environment where you can test drive new Bro versions, please give
this a try. We're interested in any feedback you have, both specific
issues you encounter (best to file tickets) and general experiences
with the new version, including in particular any observations about
performance (best to send to this list).
From a user's perspective, not much should
even be changing, most of
the new stuff is under the hood. The exception are custom
doing communication themselves, they need to be ported over to Broker.
Documentation for that is here:
, including a
porting guide for existing scripts. Let us know if there's anything
missing there that would be helpful. The Broker library itself comes
with a new user manual as well, we'll get that online shortly.
One specific note on upgrading existing Bro clusters: the meaning of
"proxy" has changed. They still exist, but play a quite different role
now. If you're currently using more than one proxy, we recommend going
back to one; that'll most likely be fine with the standard scripts
(and if not, please let us know!)
Many thanks to Jon Siwek for the recent integration work tying up all
the loose ends and getting Broker mergeable. Also thanks to those who
have tested it already from the actor-system branch.
Robin Sommer * ICSI/LBNL * robin(a)icir.org * www.icir.org/robin
bro-dev mailing list