Zeek Tuning for High-Speed Network (10 Gb/sec) on Air-Gapped Distributed Deployment

[umlumpa]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

256

RAM

512

Storage for /

300GB

Storage for /nsm

50TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

🚀 Zeek Tuning for High-Speed Network (10 Gb/sec) on Air-Gapped Distributed Deployment

Hello Security Onion team,

First of all, thank you for your excellent product! 🙌

I’m currently working on a high-speed 10 Gb/sec network and need to tune Zeek to monitor the traffic effectively.
My deployment is air-gapped and distributed.

🖥️ Sensor Node Specifications:

• RAM: 512 GB
• CPU: 256 cores (Intel Platinum)
• Storage: 50 TB (dedicated for NSM)

Everything is set up correctly and runs fine until the traffic load reaches around 6–7 Gb/sec. At that point, Zeek consumes all available memory, and the sensor node gets OOM-killed.

⚙️ Current Zeek Configuration:

• Workers: 127 (default)
• Node Buffer Size: 128 * 1024 * 1024
• Zeek CPU Affinity: 1
• CPU Affinity Enabled: false
• AF-PACKET Settings: Default

---

❓ My Question:

How can I properly tune Zeek for this kind of high-throughput environment to avoid OOM issues and improve performance?

Any advice or best practices would be greatly appreciated!

Thanks in advance! 🙏

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.