High Availability with Zeek

Zeek
1

Hi everyone.

We trying to use Zeek to monitor 4 interfaces in different machines. The idea is to have 1 Manager with 1 logger in one machine, and 4 workers to monitoring each of the interfaces. But this means that if the Manager crashes, everything goes down, I guess. So my question here is: ¿Is possible to configure a second Manager or something to reach high availability?

Regards.

Jorge García Rodríguez
Technical Consultant
Security Infrastructures
jgarciar@sia.es

Grupo SIA
Avda.Europa,2 - Alcor Plaza, Edificio B - Parque Oeste Alcorcón
28922 Alcorcón - Madrid
Tlf: +34 902 480 580 Fax: +34 91 307 79 80
www.siainternational.com

delivering value

This e-mail and any attached files are intended solely for the addresse/s identified herein. It may contain confidential and/or legally privileged information and may not necessarily represent the opinion of SIA.

No legally binding commitments will be created by this E-mail message. Where we intend to create legally binding commitments these will be made through hard copy correspondence or documents. If you receive this message by mistake, please immediately notify the sender and delete it since you are not authorized to use, disclose, distribute, print or copy all or part of the contained information Thank you. It is understood that the message was sent to you accidentally, although you appear as the addressee, you can see from the frame of existing relations that you were not the final addressee.

2

The default scripts/configuration more or less depends on there being
exactly 1 Manager. That doesn't stop someone from writing their own
scripts to handle things differently, but while that's technically
possible, it's not a trivial effort I expect a user undertake.

- Jon

3

We may be a bit further along than people realize though. With 2.6+ we have proxy failover, and I think logger failover works too if you configure more than one. If the manager dies the most noticeable issues are intel, notices, and sumstats would stop working… so I think only a few places need updating. At some point the manager process won’t be doing anything.