[Zeek] zeek worker nodes
venkatesh bandari
austin522 at gmail.com
Wed Nov 6 04:10:55 PST 2019
Hello Team,
could you please share the details if anyone of you deployed worker nodes
.a little background of what iam doing
1.installed zeek
2.we are seeing 40% packet loss on interface
3.installed pf_ring but i was not able to do the below step as
i already installed zeek(not compiled from source).It is a yum install
ldd /usr/local/bro/bin/bro | grep pcap
libpcap.so.1 => /opt/pfring/lib/libpcap.so.1
4.i went a ahead and spawn 2 worker nodes
[worker-1]
type=worker
host=localhost
interface=eth0
lb_method=pf_ring
lb_procs=10
pin_cpus=2,3,4,5,6,7,8,9,10,11
[worker-2]
type=worker
host=localhost
interface=eth0
lb_method=pf_ring
lb_procs=10
pin_cpus=12,13,14,15,16,17,18,19,20,21
5.iam still seeing packet drops after spinning 2 worker nodes
my question is did any one implement worker nodes and saw any improvements
any help is much appreciated
thanks
Venkatesh
On Wed, Nov 6, 2019 at 8:09 PM venkatesh bandari <austin522 at gmail.com>
wrote:
> Hello Team,
>
> could you please share the details if anyone of you deployed worker nodes
> .a little background of what iam doing
> 1.installed zeek
> 2.we are seeing 40% packet loss on interface
> 3.installed pf_ring but i was not able to do the below step as
> i already installed zeek(not compiled from source).It is a yum install
> ldd /usr/local/bro/bin/bro | grep pcap
> libpcap.so.1 => /opt/pfring/lib/libpcap.so.1
>
> 4.i went a ahead and spawn 2 worker nodes
> [worker-1]
> type=worker
> host=localhost
> interface=eth0
> lb_method=pf_ring
> lb_procs=10
> pin_cpus=2,3,4,5,6,7,8,9,10,11
>
> [worker-2]
> type=worker
> host=localhost
> interface=eth0
> lb_method=pf_ring
> lb_procs=10
> pin_cpus=12,13,14,15,16,17,18,19,20,21
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20191106/ea51b7ab/attachment-0001.html
More information about the Zeek
mailing list