This plugin provides a "doctor.bro" command for broctl that will help to troubleshoot various common cluster problems.
This plugin runs the following checks:
Checks if many recent connections have a SAD or had history
If any connections have a history that is one sided (all uppercase or all lowercase) this indicates that bro is only seeing half of the connection.
Checks for recent capture_loss.log entries
Capture loss should be as low as possible across all workers.
Checks what percentage of recent tcp connections show loss
Like capture loss, but instead of reporting on the absolute loss amount, report on the percentage of recent connections show any loss at all.
Checks if anything is in the deprecated local-logger.bro, local-manager.bro, local-proxy.bro, or local-worker.bro scripts
Unless you know what you are doing, you should ONLY be using local.bro.
Checks if any recent connections have been logged multiple times
Each connection should only be logged once. If a connection is logged multiple times, especially once per worker, load balancing is not working properly.
Checks if connections are unevenly distributed across workers
Usually, connections should be distributed evenly across workers. If connections are unevenly distributed, load balancing might be not working properly.
Checks what percentage of recent tcp connections are remote to remote.
This will detect problems with networks.cfg not listing all subnets that should be considered local.
Checks if bro is linked against a custom malloc like tcmalloc or jemalloc
Bro performs best when using a better malloc than the standard one in glibc.
Checks pf_ring configuration
If bro is configured to use pf_ring, it needs to be linked against it. If bro is linked against pf_ring, it should be using it.
If the bro pf_ring plugin is installed, the interface name should start with pf_ring::
Checks for recent reporter.log entries
If bro is running well, there will be zero reporter.log messages.
broctl doctor.bro [check] [check]
Run all checks
Run just the duplicate check
broctl doctor.bro check_duplicate_5_tuples