As per the docs "Packetbeat can run on the same servers as your application processes or on its own servers. When running on dedicated servers, Packetbeat can get the traffic from the switch’s mirror ports or from tapping devices" As per this blog https://blog.packet-foo.com/2014/05/the-drawbacks-of-local-packet-captures/ the author never recommends capture on local streams.
As packetbeat is published as a lightweight shipper of packet data, how lightweight it really is ?.
In our org we are trying to evaluate adopting Packbeat for monitoring network traffic over 10GB Fiber MTP. So we wanted find out how well packbeat suits our needs, what are its performance impacts when run locally or on dedicated servers.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.