Server

CPU

Heimnull runs on amd64 (x86-64) and arm64.

On amd64, the CPU must support AVX2 (the x86-64-v3 level). ClickHouse’s amd64 build needs it. Without it, ClickHouse exits as soon as it starts with “Illegal instruction” (exit code 132), and Heimnull never becomes healthy. Intel CPUs from Haswell (2013) on and AMD CPUs from Excavator on have it. Older server CPUs such as the Xeon E5-2600 v2 series can’t run Heimnull at all.

On arm64, ClickHouse needs ARMv8.2-A with RCpc, such as AWS Graviton 2 or later. A Raspberry Pi 4 can’t run it.

To check a machine:

grep -o -m1 avx2 /proc/cpuinfo

It prints avx2 if the CPU has it, and nothing if it doesn’t.

Virtual machines

A virtual machine only sees AVX2 if the hypervisor passes it through.

• Proxmox VE. Set the VM’s CPU type to host or x86-64-v3 (VM → Hardware → Processors → Type), then stop and start the VM. The default types (kvm64, x86-64-v2-AES) hide AVX2.
• Other hypervisors. Use a CPU model that includes AVX2, or pass the host CPU through. Then run the check above inside the VM.

Sizing

	Recommended	Smaller networks
CPU cores	8	4
Memory	16 GB	8 GB
Storage	SSD or NVMe, 500 GB or more	SSD or NVMe

The smaller size handles typical routers’ flow rates. What runs short first is wide searches over long time ranges: a search that needs more memory than its limit fails, but ingest and detection carry on.

The install’s env-template step sizes Heimnull for the machine it runs on, and warns below 2 CPUs and 4 GB of memory (under 7 GB is tight). It divides the server like this:

Container	Memory	CPU ceiling
Heimnull	3/8 of the server’s memory	3/4 of its CPUs
ClickHouse	3/8	1/2
PostgreSQL	1/16 (512 MB to 1 GB)	1

The rest is left to the operating system, whose page cache ClickHouse benefits from. The CPU ceilings keep a heavy search from starving ingest; they add up to more than the server has, since they’re limits, not reservations. If you resize the server later, see Environment variables.

Heimnull was load tested at 300,000 flow records a second without loss on a fast desktop CPU. Real routers send far less: a router at 10 Gbit/s with 1-in-512 packet sampling sends a few thousand records a second.

Storage

Use SSD or NVMe storage. ClickHouse writes every flow record, and spinning disks can’t keep up with merges and searches at the same time.

How much depends on your traffic and how long you keep raw flows (30 days by default):

• Raw flows take 6 to 36 bytes per stored record, compressed. A router at 10 Gbit/s average with 1-in-512 packet sampling produces about 3.5 to 8.5 GB a day.
• 1-minute rollups take tens of GB at the default retention, and 1-hour rollups a few GB a year.
• We recommend at least 500 GB of NVMe for 30 days of raw flows with headroom on a busy network.

Raw flows fill the disk first. System → Storage shows the disk use per table and a days-until-full projection. To free space, shorten the raw flow retention under Settings → Retention; rollups, attacks and peaks keep their own retention. See Storage and retention.

Docker keeps the data in its volumes, under /var/lib/docker by default, so that’s the filesystem that needs the space.