diff --git a/scripts/base/frameworks/intel/__load__.bro b/scripts/base/frameworks/intel/__load__.bro index 08d0f62222..d8c77b86e3 100644 --- a/scripts/base/frameworks/intel/__load__.bro +++ b/scripts/base/frameworks/intel/__load__.bro @@ -1,5 +1,4 @@ @load ./main -@load ./input # The cluster framework must be loaded first. @load base/frameworks/cluster @@ -7,3 +6,6 @@ @if ( Cluster::is_enabled() ) @load ./cluster @endif + +# This needs cluster support to only read on the manager. +@load ./input diff --git a/scripts/base/frameworks/intel/input.bro b/scripts/base/frameworks/intel/input.bro index a43a76f793..6ab7c6a674 100644 --- a/scripts/base/frameworks/intel/input.bro +++ b/scripts/base/frameworks/intel/input.bro @@ -16,14 +16,18 @@ event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: event bro_init() &priority=5 { - for ( a_file in read_files ) + if ( ! Cluster::is_enabled() || + Cluster::local_node_type() == Cluster::MANAGER ) { - Input::add_event([$source=a_file, - $reader=Input::READER_ASCII, - $mode=Input::REREAD, - $name=cat("intel-", a_file), - $fields=Intel::Item, - $ev=Intel::read_entry]); + for ( a_file in read_files ) + { + Input::add_event([$source=a_file, + $reader=Input::READER_ASCII, + $mode=Input::REREAD, + $name=cat("intel-", a_file), + $fields=Intel::Item, + $ev=Intel::read_entry]); + } } }