mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 12:38:20 +00:00
Update the quickstart guide for the deploy command
Also removed some redundant info about setting up a broctl cron job, which is already explained in detail in the broctl documentation.
This commit is contained in:
parent
aa8d200e80
commit
0db028ea91
2 changed files with 20 additions and 42 deletions
|
@ -105,24 +105,9 @@ a Bro cluster (do this as the Bro user on the manager host only):
|
||||||
|
|
||||||
> broctl install
|
> broctl install
|
||||||
|
|
||||||
- Some tasks need to be run on a regular basis. On the manager node,
|
- See the :doc:`BroControl <../components/broctl/README>` documentation
|
||||||
insert a line like this into the crontab of the user running the
|
for information on setting up a cron job on the manager host that can
|
||||||
cluster::
|
monitor the cluster.
|
||||||
|
|
||||||
0-59/5 * * * * <prefix>/bin/broctl cron
|
|
||||||
|
|
||||||
(Note: if you are editing the system crontab instead of a user's own
|
|
||||||
crontab, then you need to also specify the user which the command
|
|
||||||
will be run as. The username must be placed after the time fields
|
|
||||||
and before the broctl command.)
|
|
||||||
|
|
||||||
Note that on some systems (FreeBSD in particular), the default PATH
|
|
||||||
for cron jobs does not include the directories where bash and python
|
|
||||||
are installed (the symptoms of this problem would be that "broctl cron"
|
|
||||||
works when run directly by the user, but does not work from a cron job).
|
|
||||||
To solve this problem, you would either need to create symlinks
|
|
||||||
to bash and python in a directory that is in the default PATH for
|
|
||||||
cron jobs, or specify a new PATH in the crontab.
|
|
||||||
|
|
||||||
|
|
||||||
PF_RING Cluster Configuration
|
PF_RING Cluster Configuration
|
||||||
|
|
|
@ -78,15 +78,6 @@ You can leave it running for now, but to stop this Bro instance you would do:
|
||||||
|
|
||||||
[BroControl] > stop
|
[BroControl] > stop
|
||||||
|
|
||||||
We also recommend to insert the following entry into the crontab of the user
|
|
||||||
running BroControl::
|
|
||||||
|
|
||||||
0-59/5 * * * * $PREFIX/bin/broctl cron
|
|
||||||
|
|
||||||
This will perform a number of regular housekeeping tasks, including
|
|
||||||
verifying that the process is still running (and restarting if not in
|
|
||||||
case of any abnormal termination).
|
|
||||||
|
|
||||||
Browsing Log Files
|
Browsing Log Files
|
||||||
------------------
|
------------------
|
||||||
|
|
||||||
|
@ -232,23 +223,25 @@ That's exactly what we want to do for the first notice. Add to ``local.bro``:
|
||||||
inside the module.
|
inside the module.
|
||||||
|
|
||||||
Then go into the BroControl shell to check whether the configuration change
|
Then go into the BroControl shell to check whether the configuration change
|
||||||
is valid before installing it and then restarting the Bro instance:
|
is valid before installing it and then restarting the Bro instance. The
|
||||||
|
"deploy" command does all of this automatically:
|
||||||
|
|
||||||
.. console::
|
.. console::
|
||||||
|
|
||||||
[BroControl] > check
|
[BroControl] > deploy
|
||||||
bro scripts are ok.
|
checking configurations ...
|
||||||
[BroControl] > install
|
installing ...
|
||||||
removing old policies in /usr/local/bro/spool/policy/site ... done.
|
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/site ...
|
||||||
removing old policies in /usr/local/bro/spool/policy/auto ... done.
|
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/auto ...
|
||||||
creating policy directories ... done.
|
creating policy directories ...
|
||||||
installing site policies ... done.
|
installing site policies ...
|
||||||
generating standalone-layout.bro ... done.
|
generating standalone-layout.bro ...
|
||||||
generating local-networks.bro ... done.
|
generating local-networks.bro ...
|
||||||
generating broctl-config.bro ... done.
|
generating broctl-config.bro ...
|
||||||
updating nodes ... done.
|
generating broctl-config.sh ...
|
||||||
[BroControl] > restart
|
stopping ...
|
||||||
stopping bro ...
|
stopping bro ...
|
||||||
|
starting ...
|
||||||
starting bro ...
|
starting bro ...
|
||||||
|
|
||||||
Now that the SSL notice is ignored, let's look at how to send an email
|
Now that the SSL notice is ignored, let's look at how to send an email
|
||||||
|
@ -281,8 +274,8 @@ connection field is in the set of watched servers.
|
||||||
order to avoid ambiguity with the built-in address type's use of '.'
|
order to avoid ambiguity with the built-in address type's use of '.'
|
||||||
in IPv4 dotted decimal representations.
|
in IPv4 dotted decimal representations.
|
||||||
|
|
||||||
Remember, to finalize that configuration change perform the ``check``,
|
Remember, to finalize that configuration change perform the ``deploy``
|
||||||
``install``, ``restart`` commands in that order inside the BroControl shell.
|
command inside the BroControl shell.
|
||||||
|
|
||||||
Next Steps
|
Next Steps
|
||||||
----------
|
----------
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue