> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/deployment/ndr-virtual-cloud-appliances/kvm-brain/brain-deployment-in-libvirt.md).

# Brain deployment in Libvirt

How to download the KVM Brain QCOW2 disk images and deploy them for use with Libvirt.

## Downloading the latest Brain QCOW2 image

The current Brain `.qcow2` image can be downloaded from the Vectra Customer Support Portal after logging in.

The URL for the download page is: <https://support.vectra.ai/vectra/additional-resources>.

* Click on the **Download** tab.
* Click on the **KVM (Generic) .qcow2 Brain Image** and then the **File: Download** link.
  * A SHA256 hash is also provided to allow you to verify the download completed successfully.

{% hint style="info" %}
Always download a current copy when you go to deploy a new Libvirt Brain for your organization. This will save time during deployment as fewer updates will need to be downloaded after deployment. Download this file onto the Libvirt host onto which it will be deployed.
{% endhint %}

<figure><img src="https://4227135129-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHJ1ltuWFvsArFWtevnRn%2Fuploads%2FscPqJd2HmGRwS3mGn1Mx%2Fimage.png?alt=media&amp;token=6c1c8c16-0910-4ead-9de6-affc49763b2a" alt=""><figcaption></figcaption></figure>

## Deploying the Libvirt Brain

Once downloaded, the machine image can be placed in the directory of your choice and uncompressed. It is a tar file. On an Ubuntu machine the `tar -xf` command will uncompress the file fully. Using other tools may require 2 steps.

<figure><img src="https://4227135129-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHJ1ltuWFvsArFWtevnRn%2Fuploads%2FxAseCkaFoBLzYCHEQZBF%2Fimage.png?alt=media&amp;token=670d1fbe-665d-4bb4-b4ed-aa3e61cd2751" alt=""><figcaption></figcaption></figure>

The script to start the deployment is `vectra-vhe.sh` which has help that can be displayed as shown below:

```
vadmin@kvm1:~/vectra-vhe$ ./vectra-vhe.sh -h
9.14.0-10-13
Vectra Networks
KVM deployment script for Vectra virtual appliances.

USAGE: ./vectra-vhe.sh [NAME] [DISK] [DATA_DISK] [DEST_PATH] [MGT_NETWORK] [CONFIG_ID]

All arguments may be optionally provided as environment variables.

ARGS:
NAME              The name of the VM to be created.
                      default: vectra-vhe
DISK              The path to the qcow2 root disk image to either attach directly or clone.
                      default: /home/vadmin/vectra-vhe/vectra-vhe_disk-0.qcow2
DATA_DISK         The path to the qcow2 data disk image to either attach directly or clone.
                  Only applicable for brain mode.
                      default: /home/vadmin/vectra-vhe/vectra-vhe_disk-1.qcow2
DEST_PATH         The storage path for the new VM. If this is not the same directory as the disk image,
                    then the image will be copied to the path before attachment.
                      default: /home/vadmin/vectra-vhe/
MGT_NETWORK       The KVM network name to be used for management.
                      default: Ask the user to select
CONFIG_ID         The index of the VM config to use. Run without args to view the options
                      default: Ask the user to select

CONFIGURATIONS:
ID       Flavor   CPUs     Memory   Disk    
0        8CORE    8        65536    128G,512G
1        16CORE   16       131072   128G,512G
2        32CORE   32       262144   128G,512G

NETWORKS:
ID   Name
0    capture
1    default
2    nat
```

Execute the script to begin the deployment:

```
vadmin@kvm1:~/vectra-vhe$ ./vectra-vhe.sh example-vhe
[Wed Sep  9 16:22:19 UTC 2026] - Setting VM configuration
ID       Flavor   CPUs     Memory   Disk    
0        8CORE    8        65536    128G,512G
1        16CORE   16       131072   128G,512G
2        32CORE   32       262144   128G,512G
Select a configuration [0]: 0

[Wed Sep  9 16:22:25 UTC 2026] - Setting management NIC
ID   Name
0    capture
1    default
2    nat
Select a management network [0]: 1

[Wed Sep  9 16:22:29 UTC 2026] - Resizing disk /home/vadmin/vectra-vhe/vectra-vhe_disk-0.qcow2

[Wed Sep  9 16:22:29 UTC 2026] - Resizing disk /home/vadmin/vectra-vhe/vectra-vhe_disk-1.qcow2
[Wed Sep  9 16:22:29 UTC 2026] - Creating VM: example-vhe
[Wed Sep  9 16:22:37 UTC 2026] - Attaching brain data disk
[Wed Sep  9 16:22:37 UTC 2026] - Starting VM: example-vhe
```

* As you can see in the above output, you will need to select some options:
  * `VM configuration` - See the [Introduction and requirements](/deployment/ndr-virtual-cloud-appliances/kvm-brain/introduction-and-requirements.md#performance-and-kvm-requirements) in the earlier section of this guide for details on the expected performance and resource requirements for each configuration.
  * `management NIC` – Which NIC to use for the management interface of the Brain.
* Your KVM Brain will start automatically once the deployment script has finished.

## 32 Core NUMA Configuration

{% hint style="info" %}
**Please Note:**

This section applies to the 32 core Brain only. No changes are required for other Brain sizes.
{% endhint %}

<details>

<summary>Please expand to learn how to modify the NUMA configuration for 32 core Brains</summary>

{% hint style="info" %}
**Please Note:**

The 32 core Brain only supports 1 or 2 NUMA nodes. If the virtual NUMA configuration is incorrect, you might experience one of the following symptoms:

* Reduced Brain performance
* The VM reboots frequently, every 3 to 4 min
* The output of `show system-health` at the CLI of your Libvirt Brain contains a message about NUMA
  {% endhint %}

If your Libvirt host has more than one NUMA node, you might need to manually edit the machine definition to place the Brain's vCPUs in the correct host NUMA nodes. There are no built-in tools in Libvirt for creating NUMA node mappings, so you will have to modify the domain XML definition yourself. For more information, see [CPU Tuning](https://libvirt.org/formatdomain.html#cpu-tuning) and [NUMA Node Tuning](https://libvirt.org/formatdomain.html#numa-node-tuning) in the Libvirt domain XML format documentation.

{% hint style="warning" %}
**Please Note:**

Your hardware will probably be different from the example below. Make sure to create your own configuration that matches your hardware.
{% endhint %}

For example, this host has enough memory and cores to run the Brain, but each NUMA node has less than 32 cores, so the Brain needs to be configured with two NUMA nodes.

```
vadmin@kvm1:~/vectra-vhe$ numactl --hardware
available: 2 nodes (0-1)
node 0 cpus: 0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38
node 0 size: 256000 MB
node 0 free: 189715 MB
node 1 cpus: 1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39
node 1 size: 256000 MB
node 1 free: 211239 MB
node distances:
node   0   1 
  0:  10  21 
  1:  21  10
```

For this example, you would need to run `virsh edit <brain vm name>` and add the following XML to the Libvirt domain definition:

```xml
  <!-- Make sure the vcpu placement is 'static' -->
  <vcpu placement='static'>32</vcpu>
  <cpu mode='host-model' check='partial'>
    <!-- 'sockets' is the number of NUMA nodes -->
    <topology sockets='2' cores='16' threads='1'/>
    <numa>
      <!-- the first 16 vCPUs are on one host numa node with half the memory -->
      <cell id='0' cpus='0-15' memory='134217728' unit='KiB'>
        <!-- inform the guest of the node distances reported by numactl -->
        <distances>
          <sibling id='0' value='10'/>
          <sibling id='1' value='21'/>
        </distances>
      </cell>
      <!-- the last 16 vcpus are on the other host numa node -->
      <cell id='1' cpus='16-31' memory='134217728' unit='KiB'>
        <distances>
          <sibling id='0' value='21'/>
          <sibling id='1' value='10'/>
        </distances>
      </cell>
    </numa>
  </cpu>
  <!-- pin the guest vCPUs to host CPUs in the correct NUMA node -->
  <cputune>
    <vcpupin vcpu='0' cpuset='0'/>
    <vcpupin vcpu='1' cpuset='2'/>
    <vcpupin vcpu='2' cpuset='4'/>
    <vcpupin vcpu='3' cpuset='6'/>
    <vcpupin vcpu='4' cpuset='8'/>
    <vcpupin vcpu='5' cpuset='10'/>
    <vcpupin vcpu='6' cpuset='12'/>
    <vcpupin vcpu='7' cpuset='14'/>
    <vcpupin vcpu='8' cpuset='16'/>
    <vcpupin vcpu='9' cpuset='18'/>
    <vcpupin vcpu='10' cpuset='20'/>
    <vcpupin vcpu='11' cpuset='22'/>
    <vcpupin vcpu='12' cpuset='24'/>
    <vcpupin vcpu='13' cpuset='26'/>
    <vcpupin vcpu='14' cpuset='28'/>
    <vcpupin vcpu='15' cpuset='30'/>
    <vcpupin vcpu='16' cpuset='1'/>
    <vcpupin vcpu='17' cpuset='3'/>
    <vcpupin vcpu='18' cpuset='5'/>
    <vcpupin vcpu='19' cpuset='7'/>
    <vcpupin vcpu='20' cpuset='9'/>
    <vcpupin vcpu='21' cpuset='11'/>
    <vcpupin vcpu='22' cpuset='13'/>
    <vcpupin vcpu='23' cpuset='15'/>
    <vcpupin vcpu='24' cpuset='17'/>
    <vcpupin vcpu='25' cpuset='19'/>
    <vcpupin vcpu='26' cpuset='21'/>
    <vcpupin vcpu='27' cpuset='23'/>
    <vcpupin vcpu='28' cpuset='25'/>
    <vcpupin vcpu='29' cpuset='27'/>
    <vcpupin vcpu='30' cpuset='29'/>
    <vcpupin vcpu='31' cpuset='31'/>
  </cputune>
  <!-- map the guest NUMA nodes' memory to the corresponding NUMA nodes on the host -->
  <numatune>
    <memory mode='strict' nodeset='0-1'/>
    <memnode cellid='0' mode='strict' nodeset='0'/>
    <memnode cellid='1' mode='strict' nodeset='1'/>
  </numatune>
```

If the Brain was already running, make sure the changes are applied by running `virsh shutdown <brain vm name>` followed by `virsh start <brain vm name>`.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.vectra.ai/deployment/ndr-virtual-cloud-appliances/kvm-brain/brain-deployment-in-libvirt.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.