You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@ObsidianKnife suggested better ways to fine-tune node.cfg for performance as it's created by zeekdeploy.sh on the hedgehog. See cisagov#158
I'm going to for now add the following to control_vars.conf:
export ZEEK_PIN_CPUS_LOGGER=
export ZEEK_PIN_CPUS_MANAGER=
export ZEEK_PIN_CPUS_PROXY=
# zeekdeploy.sh will also check and use (if present):
# ZEEK_PIN_CPUS_WORKER_1 .. ZEEK_PIN_CPUS_WORKER_n
# where n is the number of capture interfaces
These variables will be used in creating node.cfg to add optional (only created if defined) pin_cpus sections for logger, manager, and proxy, and for each worker (1 .. n where n is the number of capture interfaces). Additionally, for the workers' lb_procs values, I will use the following order of preference, if they exist:
ZEEK_LB_PROCS_WORKER_1 .. ZEEK_LB_PROCS_WORKER_n
the number of pinned CPUs in ZEEK_PIN_CPUS_WORKER_1 .. ZEEK_PIN_CPUS_WORKER_n
the value in ZEEK_LB_PROCS (defaults to 1)
The text was updated successfully, but these errors were encountered:
mmguero
added
zeek
Relating to Malcolm's use of Zeek
sensor
For issues dealing with the Hedgehog OS capture sensor
labels
Feb 2, 2021
Malcolm v2.6.1 contains the following changes:
v2.6.0...v2.6.1
* Added [TFTP](https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol) [Zeek parser](https://github.com/zeek/spicy-tftp) and corresponding Logstash parsing, Arkime WISE support and Kibana dashboards
* Provide browser-based access to zeek/extracted-files directory (idaholab#34)
* Fix LDAP analyzer not parsing all events (idaholab#35)
* Provide more fine-tuned controls for Zeek's node.cfg in Hedgehog sensor (idaholab#36, /pull/158)
* set zeek.uid to conn_uids for files.log entries (idaholab#33)
* Modify Zeek build chain to use default GCC compilers instead of LLVM/clang,which reduces build dependencies
* Use Firefox instead of Chromium for browser in ISO-installed versions of Malcolm and in Hedgehog Linux
* Updated copyright notices in text from "2020" to "2021" (which is the bulk of the changed files in this commit)
* Version bumps
* Yara to 4.0.4
@ObsidianKnife suggested better ways to fine-tune
node.cfg
for performance as it's created byzeekdeploy.sh
on the hedgehog. See cisagov#158I'm going to for now add the following to
control_vars.conf
:in addition, this existed in there previously:
These variables will be used in creating node.cfg to add optional (only created if defined)
pin_cpus
sections forlogger
,manager
, andproxy
, and for each worker (1 .. n where n is the number of capture interfaces). Additionally, for the workers' lb_procs values, I will use the following order of preference, if they exist:ZEEK_LB_PROCS_WORKER_1
..ZEEK_LB_PROCS_WORKER_n
ZEEK_PIN_CPUS_WORKER_1
..ZEEK_PIN_CPUS_WORKER_n
ZEEK_LB_PROCS
(defaults to 1)The text was updated successfully, but these errors were encountered: