zeek worker nodes
venkatesh bandari <[email protected]> Wed, 6 Nov 2019 20:09:33 +0800
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAKPzng8Q-1pD_Yw9TM8rti+Xh52a-78J01nS1Rzc-VDCXg9oZA@mail.gmail.com> |
Hello Team,
could you please share the details if anyone of you deployed worker nodes
.a little background of what iam doing
1.installed zeek
2.we are seeing 40% packet loss on interface
3.installed pf_ring but i was not able to do the below step as
i already installed zeek(not compiled from source).It is a yum install
ldd /usr/local/bro/bin/bro | grep pcap
libpcap.so.1 => /opt/pfring/lib/libpcap.so.1
4.i went a ahead and spawn 2 worker nodes
[worker-1]
type=worker
host=localhost
interface=eth0
lb_method=pf_ring
lb_procs=10
pin_cpus=2,3,4,5,6,7,8,9,10,11
[worker-2]
type=worker
host=localhost
interface=eth0
lb_method=pf_ring
lb_procs=10
pin_cpus=12,13,14,15,16,17,18,19,20,21
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek