Thanks everyone for the replies and suggestions. Apparently I just forgot
to run 'install' after changing the node config which is embarrassing, but
I still find it interesting that they all reacted differently.
For future reference, all of the instances that fail show:
/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 14
(BroCtl::workers[WORKER]): run-time error, no such index
/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 13
$events=Remote::manager_events, $connect=T, $sync=F, $retry=1.0 min,
$class=BroCtl::workers[WORKER]$tag): run-time error, uninitialized list
/usr/local/bro/share/broctl/scripts/run-bro: line 73: 27140 Segmentation
fault (core dumped) nohup $tmpbro $@
From: Justin Azoff <JAzoff(a)uamail.albany.edu>
Date: Fri, 4 Mar 2011 19:50:23 -0500
To: Dop <dopheide(a)ncsa.illinois.edu>
Cc: "bro(a)bro-ids.org" <Bro(a)bro-ids.org>
Subject: Re: [Bro] multiple workers per cluster node
On Fri, Mar 04, 2011 at 05:29:40PM -0500, Dop wrote:
Hopefully quick question. How would you go about
nodes to each run dual clients (one per input interface)?
What's strange is that it seems to fail unevenly. Fails totally on 21,
partially on 22 and 23, but works on 24. It's always the same nodes
This should work fine, I run 4 workers on one machine without any
It sounds like maybe you have some filesystem issues preventing bro from
What do you have in /usr/local/bro/spool/ for each of the failing nodes?
Is there anything in the stdout or stderr logs?
/usr/local/bro/spool/debug.log may also have useful info
I would focus on the machine that it starts partially on.
-- Justin Azoff
-- Network Security & Performance Analyst