Recommended system requirements

Malcolm runs on top of Docker, which runs on recent releases of Linux, Apple macOS, and Microsoft Windows 10 and up. Malcolm can also be deployed with Podman, or in the cloud with Kubernetes.

To quote the Elasticsearch documentation, “If there is one resource that you will run out of first, it will likely be memory.” Malcolm requires a minimum of 8 CPU cores and 24 gigabytes of RAM on a dedicated server, but Malcolm developers recommend 16+ CPU cores and 32+ gigabytes of RAM for an optimal experience. Users will want as much available disk storage as possible (preferably solid state storage), as the amount of PCAP data a machine can analyze and store will be limited by available storage space.

When configuring the full Malcolm stack with a local OpenSearch instance under Docker or Podman, the installer warns if the host has clearly less than 24 gigabytes RAM, and on Linux it also notes whether swap space is configured. This warning doesn’t stop the installation or change any settings. Reducing the OpenSearch or Logstash Java heap sizes doesn’t make an undersized host a supported configuration, though a setup with some services disabled can still be useful for evaluation. Docker Desktop runs containers in a virtual machine with its own memory allocation, which the installer can’t see, so check that allocation separately.

Arkime’s wiki has documents (here and here and here and a calculator here) that may be helpful, although not everything in those documents will apply to a containerized setup such as Malcolm.