mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
46 lines
1.4 KiB
INI
46 lines
1.4 KiB
INI
{%- set interface = salt['pillar.get']('sensor:interface', 'bond0') %}
|
|
{%- if salt['pillar.get']('sensor:zeek_pins') or salt['pillar.get']('sensor:zeek_lbprocs') %}
|
|
{%- if salt['pillar.get']('sensor:zeek_proxies') %}
|
|
{%- set proxies = salt['pillar.get']('sensor:zeek_proxies', '1') %}
|
|
{%- else %}
|
|
{%- if salt['pillar.get']('sensor:zeek_pins') %}
|
|
{%- set proxies = (salt['pillar.get']('sensor:zeek_pins')|length/10)|round(0, 'ceil')|int %}
|
|
{%- else %}
|
|
{%- set proxies = (salt['pillar.get']('sensor:zeek_lbprocs')/10)|round(0, 'ceil')|int %}
|
|
{%- endif %}
|
|
{%- endif %}
|
|
[manager]
|
|
type=manager
|
|
host=localhost
|
|
|
|
[logger]
|
|
type=logger
|
|
host=localhost
|
|
|
|
[proxy]
|
|
type=proxy
|
|
host=localhost
|
|
|
|
[worker-1]
|
|
type=worker
|
|
host=localhost
|
|
interface=af_packet::{{ interface }}
|
|
lb_method=custom
|
|
{%- if salt['pillar.get']('sensor:zeek_lbprocs') %}
|
|
lb_procs={{ salt['pillar.get']('sensor:zeek_lbprocs', '1') }}
|
|
{%- else %}
|
|
lb_procs={{ salt['pillar.get']('sensor:zeek_pins')|length }}
|
|
{%- endif %}
|
|
{%- if salt['pillar.get']('sensor:zeek_pins') %}
|
|
pin_cpus={{ salt['pillar.get']('sensor:zeek_pins')|join(", ") }}
|
|
{%- endif %}
|
|
af_packet_fanout_id=23
|
|
af_packet_fanout_mode=AF_Packet::FANOUT_HASH
|
|
af_packet_buffer_size={{ salt['pillar.get']('sensor:zeek_buffer', 128*1024*1024) }}
|
|
{%- else %}
|
|
[zeeksa]
|
|
type=standalone
|
|
host=localhost
|
|
interface={{ interface }}
|
|
{%- endif %}
|