Skip to content

Instantly share code, notes, and snippets.

Created August 1, 2021 09:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tribalchicken/921e677a670fb1081491dbd3d12cbbf1 to your computer and use it in GitHub Desktop.
Save tribalchicken/921e677a670fb1081491dbd3d12cbbf1 to your computer and use it in GitHub Desktop.
Install Arkime (formerly Moloch) on FreeBSD

Install and configure Arkime on FreeBSD 12 / FreeBSD 13

Arkime (formerly Moloch) is a large scale, open source, indexed packet capture and search system. It is available at

Installing Arkime on FreeBSD is not officially supported according to the Arkime page - It can be done, but requires a bit of massaging.

It's fairly straightforward to get it running on FreeBSD. The key elements are to get the configure parameters right, and a few other small modifications. One of the dependencies fails to build on FreeBSD (not an Arkime issue), but that can be worked around very easily.

Install required packages

pkg install wget curl pcre flex bison gettext e2fsprogs-libuuid glib gmake autotools git yara libmaxminddb libyaml node npm pkgconf

Download Arkime

From the Git repository
git clone
cd arkime

Run autoconf

autoreconf --verbose --install --force

Configure and build Arkime

Fix broken Node dependency

The Node dependency node-iptrie is broken on FreeBSD. The original Git repo for this has a pending pull request, but the repo has not been updated in quite some time.

I'm not super familiar with Node so there is likely a better way to do this. For now I've just edited package.json to pull a build from a fixed repository (this repository is identical to the original, but with the FreeBSD fix applied) and run npm install to update the package-lock.json file.

The steps are:

  1. Edit package.json
  2. Find the line for
  3. Replace with

You can also do that with sed:
cd wiseService
sed -i '' 's/\/\/awick\/node-iptrie/\/\/tribalchicken\/node-iptrie/g' package.json

Once package.json has been modified, run:

npm install

Then move back to the original directory:

cd ..

Download and build Yara

The script usually builds Yara for you. I tried building Arkime with the latest Yara included in the FreeBSD packages (4.0.5), but the linker complained. It's possible that it could be made to work, but I suspect there is also a reason that the Arkime devs specifically call for Yara 4.0.2

Steps adapted from the original build script:

mkdir -p thirdparty/yara
wget -O thirdparty/yara/yara-4.0.2.tar.gz
cd thirdparty/yara ; tar zxf yara-4.0.2.tar.gz
cd yara-4.0.2; ./ ; ./configure --enable-static; make
cd ../../../

Run configure

./configure CFLAGS="-I/usr/local/include -I/usr/local/include/glib-2.0 -I/usr/local/include/glib-2.0/include -I/usr/local/lib/glib-2.0/include" LDFLAGS="-L/usr/local/lib" --with-yara=thirdparty/yara/yara-4.0.2 GLIB2_CFLAGS="-I/usr/local/include -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include" GLIB2_LIBS="-L/usr/local/lib"

Update Makefile

Some small modifications to the Makefile are needed to make this work. BSD install doesn't support the -D flag, so we simply remove it.

sed -i '' 's/install -c -D/install -c/g' Makefile


Make sure you use gmake



If that builds successfully, run gmake install

mkdir -p /opt/arkime
gmake install

All going well you should now be able to configure Arkime as per usual, and point it to your Elasticsearch instance. Follow the install instructions and run /opt/arkime/bin/Configure

Init scripts

I use these init scripts to control arkimecapture and arkimeviewer on startup:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment