How to deploy Metron on CentOS VM of VMware?

[#1]

I create VM CentOS on VMware. I want to deploy Metron on it. Can you help me. Many Thanks.

[#2 · Accepted solution]

Hello @Lee Adrian,

The following article should help with deploying a Metron cluster using Ambari:

https://community.hortonworks.com/articles/60805/deploying-a-fresh-metron-cluster-using-ambari-serv....

If you are looking to deploy a vagrant-based quick-dev environment, then the instructions are here:

https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/quick-dev-platform

[#3]

Hello @asubramanian

I tried your guide. But I don't understand add services for master & slave nodes. Can you help me?

Many thanks.

[#4]

Hi @Lee Adrian, are you referring to the HCC article or the quick-dev github page? If its the former, can you tell me which step are you having trouble with?

[#5]

Hi @asubramanian

Thank you for answering my questions. I try configure follow your guide

[#6]

HI @Lee Adrian, were you able to resolve the issue?

[#7]

Hi @asubramanian, Thanks you. I done configured follow your guide, but I don't pattern Bro log on Kibana. Can you help me?

[#8]

I find on /usr/metron/0.3.0/patterns path but It's have asa, common, fireeye, sourcefire, squid, websphere, yaf files.

[#9]

Hi @Lee Adrian,

Metron uses a BasicBroParser and hence you dont see a pattern for bro. As you can see from the output below for bro and squid:

[root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/bro.json
{
  "parserClassName":"org.apache.metron.parsers.bro.BasicBroParser",
  "sensorTopic":"bro",
  "parserConfig": {}
}

[root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/squid.json
{
  "parserClassName": "org.apache.metron.parsers.GrokParser",
  "sensorTopic": "squid",
  "parserConfig": {
    "grokPath": "/patterns/squid",
    "patternLabel": "SQUID_DELIMITED",
    "timestampField": "timestamp"
  },
  "fieldTransformations" : [
    {
      "transformation" : "STELLAR"
    ,"output" : [ "full_hostname", "domain_without_subdomains" ]
    ,"config" : {
      "full_hostname" : "URL_TO_HOST(url)"
      ,"domain_without_subdomains" : "DOMAIN_REMOVE_SUBDOMAINS(full_hostname)"
                }
    }
                           ]
}

[#10]

If you think that my answer helped you, can you please mark it as accepted? Thank you!