mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 04:28:20 +00:00
Update the quickstart guide for the deploy command
Also removed some redundant info about setting up a broctl cron job, which is already explained in detail in the broctl documentation.
This commit is contained in:
parent
aa8d200e80
commit
0db028ea91
2 changed files with 20 additions and 42 deletions
|
@ -105,24 +105,9 @@ a Bro cluster (do this as the Bro user on the manager host only):
|
|||
|
||||
> broctl install
|
||||
|
||||
- Some tasks need to be run on a regular basis. On the manager node,
|
||||
insert a line like this into the crontab of the user running the
|
||||
cluster::
|
||||
|
||||
0-59/5 * * * * <prefix>/bin/broctl cron
|
||||
|
||||
(Note: if you are editing the system crontab instead of a user's own
|
||||
crontab, then you need to also specify the user which the command
|
||||
will be run as. The username must be placed after the time fields
|
||||
and before the broctl command.)
|
||||
|
||||
Note that on some systems (FreeBSD in particular), the default PATH
|
||||
for cron jobs does not include the directories where bash and python
|
||||
are installed (the symptoms of this problem would be that "broctl cron"
|
||||
works when run directly by the user, but does not work from a cron job).
|
||||
To solve this problem, you would either need to create symlinks
|
||||
to bash and python in a directory that is in the default PATH for
|
||||
cron jobs, or specify a new PATH in the crontab.
|
||||
- See the :doc:`BroControl <../components/broctl/README>` documentation
|
||||
for information on setting up a cron job on the manager host that can
|
||||
monitor the cluster.
|
||||
|
||||
|
||||
PF_RING Cluster Configuration
|
||||
|
|
|
@ -78,15 +78,6 @@ You can leave it running for now, but to stop this Bro instance you would do:
|
|||
|
||||
[BroControl] > stop
|
||||
|
||||
We also recommend to insert the following entry into the crontab of the user
|
||||
running BroControl::
|
||||
|
||||
0-59/5 * * * * $PREFIX/bin/broctl cron
|
||||
|
||||
This will perform a number of regular housekeeping tasks, including
|
||||
verifying that the process is still running (and restarting if not in
|
||||
case of any abnormal termination).
|
||||
|
||||
Browsing Log Files
|
||||
------------------
|
||||
|
||||
|
@ -232,23 +223,25 @@ That's exactly what we want to do for the first notice. Add to ``local.bro``:
|
|||
inside the module.
|
||||
|
||||
Then go into the BroControl shell to check whether the configuration change
|
||||
is valid before installing it and then restarting the Bro instance:
|
||||
is valid before installing it and then restarting the Bro instance. The
|
||||
"deploy" command does all of this automatically:
|
||||
|
||||
.. console::
|
||||
|
||||
[BroControl] > check
|
||||
bro scripts are ok.
|
||||
[BroControl] > install
|
||||
removing old policies in /usr/local/bro/spool/policy/site ... done.
|
||||
removing old policies in /usr/local/bro/spool/policy/auto ... done.
|
||||
creating policy directories ... done.
|
||||
installing site policies ... done.
|
||||
generating standalone-layout.bro ... done.
|
||||
generating local-networks.bro ... done.
|
||||
generating broctl-config.bro ... done.
|
||||
updating nodes ... done.
|
||||
[BroControl] > restart
|
||||
[BroControl] > deploy
|
||||
checking configurations ...
|
||||
installing ...
|
||||
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/site ...
|
||||
removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/auto ...
|
||||
creating policy directories ...
|
||||
installing site policies ...
|
||||
generating standalone-layout.bro ...
|
||||
generating local-networks.bro ...
|
||||
generating broctl-config.bro ...
|
||||
generating broctl-config.sh ...
|
||||
stopping ...
|
||||
stopping bro ...
|
||||
starting ...
|
||||
starting bro ...
|
||||
|
||||
Now that the SSL notice is ignored, let's look at how to send an email
|
||||
|
@ -281,8 +274,8 @@ connection field is in the set of watched servers.
|
|||
order to avoid ambiguity with the built-in address type's use of '.'
|
||||
in IPv4 dotted decimal representations.
|
||||
|
||||
Remember, to finalize that configuration change perform the ``check``,
|
||||
``install``, ``restart`` commands in that order inside the BroControl shell.
|
||||
Remember, to finalize that configuration change perform the ``deploy``
|
||||
command inside the BroControl shell.
|
||||
|
||||
Next Steps
|
||||
----------
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue