Update cluster documentation


We should update the Cluster documentation, if possible before releasing 2.3.

I set up a Bro cluster for the first time yesterday - and when you look at the current state at the documentation it is not very useful...

...for example it contains things like (link to an example for the config) in the text. Furthermore it does not really mention how to actually configure Bro for a cluster, there is no mention of node.cfg, etc.




Daniel Thayer
March 19, 2014, 10:05 PM

In branch topic/dnthayer/ticket1160 (bro and broctl repos), I've improved
the documentation (and added links so that the content is easier to find).

March 18, 2014, 9:40 PM

Do we actually have any documentation on how to configure a Bro cluster?

I just might be really blind, but I drew a blank yesterday...

Daniel Thayer
March 18, 2014, 9:14 PM

I believe that the cluster doc that exists currently was not intended to provide
details like which config files to edit, but rather to explain the components that
make up the bro cluster architecture and provide a high-level discussion of related
topics such as load balancing. It's the type of document someone should read
before installing Bro, because it provides background information that could help
to guess what hardware might be needed to deploy a Bro cluster, and which type of
load-balancing to use.

I think the title of the page is misleading (rather than "setting up a bro cluster", it
should probably be something like "bro cluster architecture"). Similarly, it would
make more sense if the document were moved up, between the introduction section
and the installing bro section.

Adding more links to other documents (for example, Justin wrote some useful documentation
on configuring Bro with PF_RING) will help avoid duplicating information.

The existing instructions on configuring a Bro cluster could be improved, as well.

Seth Hall
March 18, 2014, 7:41 PM

Agreed, this is definitely something that we need to have official documentation on. Supplementing with videos and other documents couldn't hurt but we need the official docs first.

March 18, 2014, 6:50 PM

Thanks . I was able to set it up without too many problems - but I just think the current state of documentation might make it a tad difficult for people that are not as familiar with Bro.

Having a step by step walkthough (like in the one in the blog post you liked) in the official documentation would probably be a good idea.



Daniel Thayer


Johanna Amann


External issue ID



Fix versions

Affects versions