<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Hi everyone,<br>
</span>
<div><br>
</div>
<div>We have been having troubles with Zeek. I hope that you can help me to solve this.<br>
</div>
<div><br>
</div>
<div>We have 4 machines with this Hardware:<br>
</div>
<div><br>
</div>
<div>SFP+, SR, transceptor óptico, Intel,10 Gb-1 Gb,<br>
</div>
<div>PowerEdge R340 Server [PowerEdge R340 - Full Configuration - [EMEA_R340_VI_VP]]<br>
</div>
<div>PowerEdge R340 Motherboard<br>
</div>
<div>Intel Xeon E-2136 3.3GHz, 12M cache, 6Cores/12Threads, turbo (80W)<br>
</div>
<div>555-BCKN Adaptador PCIe Intel X710 two interfaces 10 GbE SFP+<br>
</div>
<div>64GB 2666MT/s DDR4 ECC UDIMM<br>
</div>
<div><br>
</div>
<div>This machines are running just the Zeek processes and a Filebeat to send the logs to our SIEM.<br>
</div>
<div><br>
</div>
<div>The thing is that we need to process a maximun of 4-5 GB/s per machine.</div>
<div><br>
</div>
<div> Now we are just processing 1,5GB/s and we have all the cores at 70% of charge, which we think that is too much for this amount of traffic. </div>
<div><br>
</div>
<div>Our workers config in the node.cfg looks like this:<br>
</div>
<div><br>
</div>
<div>[Zeek-1-W-1]<br>
</div>
<div>type=worker<br>
</div>
<div>host=localhost<br>
</div>
<div>interface=p1p1<br>
</div>
<div>lb_method=pf_ring<br>
</div>
<div>lb_procs=5<br>
</div>
<div>pin_cpus=0,1,2,3,4<br>
</div>
<div><br>
</div>
<div>[Zeek-1-W-2]<br>
</div>
<div>type=worker<br>
</div>
<div>host=localhost<br>
</div>
<div>interface=p1p2<br>
</div>
<div>lb_method=pf_ring<br>
</div>
<div>lb_procs=5<br>
</div>
<div>pin_cpus=5,6,7,8,9<br>
</div>
<div><br>
</div>
<div>We have tested with different number of RSS queues with no success.<br>
</div>
<div><br>
</div>
<div>Now we are using PF_RING but we have tested with AF_Packet plugin with the same results.<br>
</div>
<div><br>
</div>
<div>Also we have tested different driver updates for our network card with the same results:
<br>
</div>
<div><br>
</div>
<div>i40e-2.11.25_sourceforge<br>
</div>
<div>i40e-2.10.19.82_intel<br>
</div>
<div><br>
</div>
<div>We also have tried with diferent versions of Zeek 3.0.1 and 3.1.1 with the same results.<br>
</div>
<div><br>
</div>
<div>Hope you can help me to improve the performance of our machines, Thank you.<br>
</div>
<div><br>
</div>
<div>Best Regards<br>
</div>
<span></span><br>
</div>
</body>
</html>