cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://cisagov.github.io/Malcolm/
Other
1.91k stars 319 forks source link

Restart Policy in docker-compose.yml file #307

Closed Kush2000528 closed 4 months ago

Kush2000528 commented 4 months ago

💡 Summary

What is the work, as a high-level summary?

Motivation and context

Why does this work belong in this project?

This would be useful because...

Implementation notes

Please provide details for implementation, such as:

Acceptance criteria

How do we know when this work is done?

Kush2000528 commented 4 months ago

Screenshot 2024-04-25 134225 Screenshot 2024-04-25 134258

There Is Issue In docker-compose.yml file in my running container is health check is failed so my container is down so the restart policy set "no" so how can I set my container into running state

mmguero commented 4 months ago

I'm not sure I understand your question completely, but during the MAlcolm configuration you are asked "Restart Malcolm upon system or Docker daemon restart?"

If the opensearch container is not staying up, that is almost always a resource issue. You've probably got it not assigned enough resources.

  1. What is the amount of RAM on the system?
  2. How much do you have assigned to opensearch?
    • grep Xms ./config/*.env
  3. ./scripts/logs -s opensearch
    • share the output of those logs

Malcolm recommends 32GB of system memory, with an absolute minimum of 16GB. Containers not staying up is usually the result of not having enough resources available.

Kush2000528 commented 4 months ago

Thanks For Your Response My Second Question is Can You Define for me how much storage and memory or CPU I can give to the sensor my sensor is working properly without any lag and high utilization ?

mmguero commented 4 months ago

For Malcolm, minimum system memory is 16GB and 8 CPU cores, but recommended is 32GB memory and 16+ CPU cores. For Hedgehog linux (standalone network sensor) minimum system memory is 8GB and 4 CPU cores, but recommended is 16GB and 8+ cores.

Kush2000528 commented 4 months ago

Can You Define for Me Which Is the Best Opensource Monitoring Tool for docker containers?

mmguero commented 4 months ago

I don't have much of an opinion on monitoring tools. I know prometheus combined with grafana is popular. I suggest you google some and test some out and find which ones work for you.