I Need Guidance on Optimizing Zeek for High-Traffic Environments

Hello guys! :smiling_face_with_three_hearts:

I am managing a network security infrastructure for a mid-sized enterprise experiencing rapid growth. We rely heavily on Zeek to monitor our network traffic, but the increasing volume is putting pressure on our current setup.

To ensure optimal performance and reliability, I’m seeking expert advice on enhancing our Zeek deployment. Specifically, I’m interested in best practices for:

  • Hardware configuration: Identifying the ideal CPU, memory, and storage specifications to handle high-throughput traffic.
  • Zeek tuning: Optimizing Zeek configurations and scripts for peak performance under heavy load.
  • Log management: Efficiently storing and managing the vast amount of generated logs without impacting system performance.
  • Zeek clustering: Implementing a robust Zeek cluster to distribute the workload effectively.

I also check this: https://community.zeek.org/t/monitoring-of-intra-virtual-machines-network-traffic-on-same-physical-hosalteryx But I have not found any solution. Could anyone provide me the best solution for this? I would appreciate any insights, recommendations, or resource suggestions from those who have successfully managed similar challenges.

Thanks in advance! :innocent:

Respected community member :blush: