Install Metron in HDP 2.4 sanbox vmware

[#1]

I have followed the steps to install the metron topologies and UI in HDP sandbox 2.4.

Maven Installation in CentOs

====================================

wget http://mirror.fibergrid.in/apache/maven/maven-3/3.3.9/binaries/apache-maven-3.3.9-bin.tar.gz

$ sudo tar xzf apache-maven-3.3.9-bin.tar.gz -C /usr/local

$ cd /usr/local

$ sudo ln -s apache-maven-3.3.9 maven

Download and Build Metron

============================

wget https://dist.apache.org/repos/dist/dev/incubator/metron/0.1BETA-RC7-incubating/apache-metron-0.1BETA...

tar -zxvf apache-metron-0.1BETA-RC7-incubating.tar.gz

cd incubator-metron-Metron_0.1BETA_rc7

mvn apache-rat:check && cd metron-streaming && mvn clean integration-test && cd ..

Deploy Storm Topologies

=============================

storm jar target/Metron-Topologies-0.1BETA.jar org.apache.storm.flux.Flux --remote src/main/resources/Metron_Configs/topologies/bro/remote.yaml --filter src/main/resources/Metron_Configs/etc/env/config.properties

storm jar target/Metron-Topologies-0.1BETA.jar org.apache.storm.flux.Flux --remote src/main/resources/Metron_Configs/topologies/enrichment/remote.yaml --filter src/main/resources/Metron_Configs/etc/env/config.properties

storm jar target/Metron-Topologies-0.1BETA.jar org.apache.storm.flux.Flux --remote src/main/resources/Metron_Configs/topologies/snort/remote.yaml --filter src/main/resources/Metron_Configs/etc/env/config.properties

storm jar target/Metron-Topologies-0.1BETA.jar org.apache.storm.flux.Flux --remote src/main/resources/Metron_Configs/topologies/yaf/remote.yaml --filter src/main/resources/Metron_Configs/etc/env/config.properties

metron-ui

==========

yum install -y libpcap-dev tshark redis-server nodejs npm

yum install libpcap-devel

yum install wireshark

$ wget http://download.redis.io/releases/redis-2.8.3.tar.gz

$ tar xzvf redis-2.8.3.tar.gz

$ cd redis-2.8.3

$ make

ln -s /usr/bin/nodejs /usr/bin/node

npm install -g pm2

mkdir /opt/portal

cd /root/incubator-metron-Metron_0.1BETA_rc7/metron-ui

cp -r * /opt/portal

cd /opt/portal/

[root@sandbox portal]# cat config.json

{

"auth":false,

"secret":"secret",

"elasticsearch": { "url": "http://host:port" },

"redis": {

"host": "127.0.0.1",

"port": 6379

},

"ldap": {

"url": "ldap://127.0.0.1:389",

"searchBase": "dc=metron,dc=dev",

"searchFilter": "(mail={{username}})",

"searchAttributes": ["cn", "uid", "mail", "givenName", "sn", "memberOf"],

"adminDn": "cn=admin,dc=metron,dc=dev",

"adminPassword": "metron"

},

"permissions": {

"pcap": "cn=investigators,ou=groups,dc=metron,dc=dev"

}

}

Now after all this steps:

- Storm topology are deployed sucessfully.

But I am not able to access the Metron UI, not sure how do I access it , on which port? I tired for 5000 and it didn't work.

[#2 · Accepted solution]

I would suggest that you use the provided Ansible scripts to perform the deployment. Doing it all manually is quite a challenge and easy to mess up.

[#3]

Thanks nallen. Finally able to build a VM with everything installed and ready to explore. The next action item is to install it in a cluster.