Zeek Scaling for higher data rate

Zeek
1

Here I have 2 questions

  1. How much workers are supported by zeek (maximum limit) ?
  2. Is it possible to use 2 instances of zeek on same machine ?
2

To give short answers to these questions:

  1. As far as I am aware, in theory you can run as many workers as you want. There are, however, practical limitations to consider - like the amount of main memory in the system, and the fact that - at some point of time - the communication between the manager and workers will get overloaded.
  2. Yes, it is possible to have several instances of Zeek active on the same machine. You might have to adjust some configuration settings to make sure their communication ports don’t interfere with each other.