# Zeek Network Security Monitor
#
# This configuration file is used by the zeek-systemd-generator executable
# to generate systemd unit files for the different Zeek components at systemd
# daemon-reload time. See the accompanying README for more details.
# The configuration itself isn't systemd specific and conceptionally it can
# be used to produce scripts or artifacts for other supervisors (supervisord,
# runit, ...), too.
#
# Configure the interface this Zeek deployment will be monitoring
# on the local system. Currently, a single interface is supported.
# The interface supports the following substitution variables
# for templating purposes:
#
#   worker_index:  1, 2, 3, ...
#   worker_index0: 0, 1, 2, ...
#   worker_cpu:    CPU from workers_cpu_list or empty if not set.
#
# Use Linux's AF_PACKET (built-in) relying on the kernel's
# default packet dissector for load balancing.
# interface = af_packet::wlp0s20f3
#
#
# # Use libpcap for listening on loopback
# interface = lo
#
# # Other examples:
# interface = napatech::${worker_index0}     # Napatech streams
# interface = netmap::eth0}${worker_index0}  # Using NETMAP pipes
#
# An empty interface means Zeek is disabled on the system.
interface =

# The number of Zeek worker processes to run.
# workers = 1

# The list of CPUs on which to pin workers (modulo semantics).
# # Pinning is disabled when this list is empty.
# workers_cpu_list =
#
# # Workers are sequentially pinned to the expanded CPU list. For below example,
# # worker-1 is pinned to CPU 0, worker-2 to CPU 1, and so on.
# workers_cpu_list = 0,1,2,3
#
# # Ranges and strides are allowed (yields CPUs 0, 2, 4, 6, 8, 10, 13, 16, 19)
# workers_cpu_list = 0-8:2,10-20:3

# The NUMA policy to set for all workers.
# Allowed values are currently default and local.
# workers_numa_policy = local

# The number of logger processes to run.
# loggers = 1

# The number of proxy processes to run.
# proxies = 1

# Arguments passed to all Zeek nodes.
#
# Keep this list short. More extensive configuration should be done
# via local.zeek or the Configuration framework. Worker processes have
# the ``-i <interface>`` prepended. Default is to load local.zeek
# args = local

# Prepend the following paths to ZEEKPATH. You might want to use this
# with scripts in unusual locations and you want to let Zeek know about
# these. If you solely use zkg, you should not need to set anything here.
# ext_zeek_path = /path/to/extra1:/path/to/extra2

# The PATH to set for Zeek. The default is always as shown below with
# the base_dir / bin directory prepended.
# path = /usr/local/bin:/usr/bin:/bin

# Prepend the following paths to PATH. See also path.
# ext_path = /opt/napatech/bin

# Override Zeek's base directory.
# base_dir =

# Cluster

# Arguments place on Zeek's command-line specific for the cluster backend
# configuration. The default is to enable the ZeroMQ cluster backend.
# cluster_backend_args = frameworks/cluster/backend/zeromq/connect

# The base port for Zeek's listener ports in a Zeek cluster.
# port = 27760
#
# The base port for the Prometheus HTTP listener for each process.
# metrics_port = 9991

# Default listening addresses to use for cluster functionality.
# address = 127.0.0.1

# The listening address for the Prometheus HTTP listener.
# This will be redef'ed in cluster-layout.zeek
# metrics_address = 127.0.0.1


# Archiver

# Zeek logger processes usually rotate their completed log files into
# <PREFIX>/spool/log-queue. The zeek-archiver process then picks up
# these logs and archives them into <PREFIX>/var/logs/zeek/<date>. If
# your Zeek configuration is such that logs are directly sent to Kafka
# or another queueing system, set this to 0.
# archiver = 1

# Extra arguments passed to the zeek-archiver invocation.
# archiver_args = -v -i 5

# Zeek process control and confinement

# User and group to run Zeek under, defaults to zeek:zeek.
# user = zeek
# group = zeek

# The maximum amount of memory an individual process type may
# consume. The default unit is bytes, you may add K, M, G, T
# suffixes as supported by systemd. On Linux, this is enforced
# using cgroups.
#
# <node_type>_memory_max = 1234M
# manager_memory_max =
# logger_memory_max =
# proxy_memory_max =
# worker_memory_max =

# The nice levels to configure for individual processes types.
# manager_nice = 0
# worker_nice = 0
# proxy_nice = 0
# logger_nice = 0

# Default restart interval a Zeek process unexpectedly terminates.
# restart_interval_sec = 1
