Skip to content

A Docker container for Arkime based on Ubuntu

License

Notifications You must be signed in to change notification settings

pp-/docker-arkime

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Arkime Docker image/container

This repository contains the files to build a Docker image of the Arkime software:

https://arkime.com/

Ready to use Docker images can be pulled from https://hub.docker.com/r/mammo0/docker-arkime

To run this image a working Elasticsearch environment is required. Please stick to their documentation for setting this up. (E.g. for docker: https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html)

Run the container

This image can be run with

docker run \
    -e ES_HOST=elasticsearch \
    -e ES_PORT 9200 \
    -v <config_volume>:/data/config \
    -v <pcap_volume>:/data/pcap \
    -v <log_volume>:/data/logs \
    mammo0/docker-arkime:<tag>

These parameters are available:

ENV VARIABLE DEFAULT VALUE NOTES
ES_HOST elasticsearch The hostname or IP address where Elasticsearch is running.
ES_PORT 9200 The port where Elasticsearch is reachable.
ARKIME_ADMIN_PASSWORD admin This is the password for the Arkime admin user that is needed for the first login. It can be changed afterwards.
ARKIME_INTERFACE eth0 Network interface where capture process listens. This feature is not tested yet!
ARKIME_HOSTNAME localhost With this hostname Arkime authenticates at Elasticsearch. So if you change this you'll lose your Elasticsearch configuration.
CAPTURE off Set to "on" to activate the capture process. This feature is not tested yet!
VIEWER on Set to "off" to deactivate the Arkime viewer.
VOLUME CONTAINER PATH NOTES
config_volume /data/config In this directory the Arkime configuration is saved.
pcap_volume /data/pcap In this directory the pcap files are saved that are generated by capture.
log_volume /data/logs In this directory the Arkime log files are saved.

Use docker-compose

You can use docker-compose if you want to setup Elasticsearch together with Arkime in one step.

Configuration

  1. Please ensure you have done this step (otherwise Elasticsearch won't start): https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html

  2. Run chmod -R 777 es_data OR chown -R 1000:1000 es_data. This is needed for the Elasticsearch containers to be able to write to that direcotry.

Start

Simply run

docker-compose up

It can take some time until the Elasticsearch instances are fully started.

The Arkime viewer instance can be accessed via

http://localhost:8005

Assuming you don't changed the default port in the .env file.

Import pcap files

To import existing pcap files have a look at scripts/arkime-parse-pcap-folder.sh script. It can be run within the running container:

docker exec -it <container_name> \
    /data/arkime-parse-pcap-folder.sh -d <directory_with_pcap_files> -t <tag>

If parameter -d is omitted, the script asks if you want to import the default direcotry /data/pcap.

About

A Docker container for Arkime based on Ubuntu

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Shell 80.2%
  • Dockerfile 19.8%