question Re: How to deploy Metron on CentOS VM of VMware? in Archives of Support Questions (Read Only)

How to deploy Metron on CentOS VM of VMware?

adroot16 — Wed, 01 Mar 2017 14:48:33 GMT

I create VM CentOS on VMware. I want to deploy Metron on it. Can you help me. Many Thanks.

Re: How to deploy Metron on CentOS VM of VMware?

asubramanian — Wed, 01 Mar 2017 15:01:03 GMT

Hello @Lee Adrian,

The following article should help with deploying a Metron cluster using Ambari:

https://community.hortonworks.com/articles/60805/deploying-a-fresh-metron-cluster-using-ambari-serv.html

If you are looking to deploy a vagrant-based quick-dev environment, then the instructions are here:

https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/quick-dev-platform

Re: How to deploy Metron on CentOS VM of VMware?

adroot16 — Wed, 01 Mar 2017 15:14:30 GMT

Hi @asubramanian

Thank you for answering my questions. I try configure follow your guide

Re: How to deploy Metron on CentOS VM of VMware?

zeolla — Thu, 02 Mar 2017 02:19:22 GMT

What version of CentOS? If you just have a CentOS VM and want to install quick-dev of full-dev, you can run my script here, but it only works on 6.8.

Re: How to deploy Metron on CentOS VM of VMware?

adroot16 — Fri, 10 Mar 2017 15:47:40 GMT

Hello @Jon Zeolla.

I use CentOS 7. I will try your script on CentOS 6.8. How many node do build on your script?

Re: How to deploy Metron on CentOS VM of VMware?

adroot16 — Fri, 10 Mar 2017 16:08:53 GMT

Hello @asubramanian

I tried your guide. But I don't understand add services for master & slave nodes. Can you help me?

Many thanks.

Re: How to deploy Metron on CentOS VM of VMware?

asubramanian — Fri, 10 Mar 2017 18:09:43 GMT

Hi @Lee Adrian, are you referring to the HCC article or the quick-dev github page? If its the former, can you tell me which step are you having trouble with?

Re: How to deploy Metron on CentOS VM of VMware?

zeolla — Fri, 10 Mar 2017 19:09:44 GMT

It builds whichever vagrant setup you choose, so the default quick dev, full, etc. Also note that I think some changes will be hitting Metron master today which aren't entirely tested with my script yet, and that also soft requires centos7 (it really requires docker which isn't officially supported on centos6 but you can get it to work if you want. YMMV). If you want to alpha test my centos7 script, checkout the centos7 branch.

Re: How to deploy Metron on CentOS VM of VMware?

zeolla — Sat, 11 Mar 2017 04:17:58 GMT

I worked on this some more today. Given all of the recent build changes to Metron master and the fact that ansible 2.0.0.2 is broken in numerous ways (pip install is broken, brew install is broken, etc.) I gave up and I'm focusing on the upgrade to ansible 2.2. The centos7 branch of my script does not work and will be abandoned.

Re: How to deploy Metron on CentOS VM of VMware?

asubramanian — Thu, 16 Mar 2017 13:10:13 GMT

HI @Lee Adrian, were you able to resolve the issue?

Re: How to deploy Metron on CentOS VM of VMware?

adroot16 — Wed, 29 Mar 2017 08:43:14 GMT

Hi @asubramanian, Thanks you. I done configured follow your guide, but I don't pattern Bro log on Kibana. Can you help me?

Re: How to deploy Metron on CentOS VM of VMware?

adroot16 — Thu, 30 Mar 2017 10:24:17 GMT

I find on /usr/metron/0.3.0/patterns path but It's have asa, common, fireeye, sourcefire, squid, websphere, yaf files.

Re: How to deploy Metron on CentOS VM of VMware?

asubramanian — Thu, 30 Mar 2017 17:30:37 GMT

Hi @Lee Adrian,

Metron uses a BasicBroParser and hence you dont see a pattern for bro. As you can see from the output below for bro and squid:

[root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/bro.json
{
  "parserClassName":"org.apache.metron.parsers.bro.BasicBroParser",
  "sensorTopic":"bro",
  "parserConfig": {}
}

[root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/squid.json
{
  "parserClassName": "org.apache.metron.parsers.GrokParser",
  "sensorTopic": "squid",
  "parserConfig": {
    "grokPath": "/patterns/squid",
    "patternLabel": "SQUID_DELIMITED",
    "timestampField": "timestamp"
  },
  "fieldTransformations" : [
    {
      "transformation" : "STELLAR"
    ,"output" : [ "full_hostname", "domain_without_subdomains" ]
    ,"config" : {
      "full_hostname" : "URL_TO_HOST(url)"
      ,"domain_without_subdomains" : "DOMAIN_REMOVE_SUBDOMAINS(full_hostname)"
                }
    }
                           ]
}

Re: How to deploy Metron on CentOS VM of VMware?

asubramanian — Thu, 30 Mar 2017 17:31:40 GMT

If you think that my answer helped you, can you please mark it as accepted? Thank you!

Re: How to deploy Metron on CentOS VM of VMware?

adroot16 — Fri, 31 Mar 2017 08:37:02 GMT

Hi @asubramanian. Thank you for your reply. I done configured. Index pattern is bro_index_*

Re: How to deploy Metron on CentOS VM of VMware?

asubramanian — Fri, 31 Mar 2017 13:00:32 GMT

That's great, @Lee Adrian! You're welcome!

Re: How to deploy Metron on CentOS VM of VMware?

adroot16 — Sat, 01 Apr 2017 14:25:51 GMT

Hi @asubramanian

I run command on YAF Server but Kibana not pattern index yaf_index*. Can you help me?

nohup /usr/local/bin/yaf --silk --ipfix=tcp --live=pcap --out=node1 --ipfix-port=6667 --in=eth0 --applabel --max-payload=384 &

Re: How to deploy Metron on CentOS VM of VMware?

sureshru — Tue, 13 Jun 2017 13:38:51 GMT

Hi @asubramanian,

Is it recommended to run Metron on Docker?