Support Questions
Find answers, ask questions, and share your expertise

How to deploy Metron on CentOS VM of VMware?

Solved Go to solution

How to deploy Metron on CentOS VM of VMware?

Explorer

I create VM CentOS on VMware. I want to deploy Metron on it. Can you help me. Many Thanks.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Super Collaborator

Hello @Lee Adrian,

The following article should help with deploying a Metron cluster using Ambari:

https://community.hortonworks.com/articles/60805/deploying-a-fresh-metron-cluster-using-ambari-serv....

If you are looking to deploy a vagrant-based quick-dev environment, then the instructions are here:

https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/quick-dev-platform

View solution in original post

17 REPLIES 17
Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Super Collaborator

Hello @Lee Adrian,

The following article should help with deploying a Metron cluster using Ambari:

https://community.hortonworks.com/articles/60805/deploying-a-fresh-metron-cluster-using-ambari-serv....

If you are looking to deploy a vagrant-based quick-dev environment, then the instructions are here:

https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/quick-dev-platform

View solution in original post

Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Explorer

Hello @asubramanian

I tried your guide. But I don't understand add services for master & slave nodes. Can you help me?

Many thanks.

Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Super Collaborator

Hi @Lee Adrian, are you referring to the HCC article or the quick-dev github page? If its the former, can you tell me which step are you having trouble with?

Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Explorer

Hi @asubramanian

Thank you for answering my questions. I try configure follow your guide

Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Super Collaborator

HI @Lee Adrian, were you able to resolve the issue?

Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Explorer

Hi @asubramanian, Thanks you. I done configured follow your guide, but I don't pattern Bro log on Kibana. Can you help me?

Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Explorer

I find on /usr/metron/0.3.0/patterns path but It's have asa, common, fireeye, sourcefire, squid, websphere, yaf files.

Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Super Collaborator

Hi @Lee Adrian,

Metron uses a BasicBroParser and hence you dont see a pattern for bro. As you can see from the output below for bro and squid:

[root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/bro.json
{
  "parserClassName":"org.apache.metron.parsers.bro.BasicBroParser",
  "sensorTopic":"bro",
  "parserConfig": {}
}

[root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/squid.json
{
  "parserClassName": "org.apache.metron.parsers.GrokParser",
  "sensorTopic": "squid",
  "parserConfig": {
    "grokPath": "/patterns/squid",
    "patternLabel": "SQUID_DELIMITED",
    "timestampField": "timestamp"
  },
  "fieldTransformations" : [
    {
      "transformation" : "STELLAR"
    ,"output" : [ "full_hostname", "domain_without_subdomains" ]
    ,"config" : {
      "full_hostname" : "URL_TO_HOST(url)"
      ,"domain_without_subdomains" : "DOMAIN_REMOVE_SUBDOMAINS(full_hostname)"
                }
    }
                           ]
}
Highlighted

Re: How to deploy Metron on CentOS VM of VMware?

Super Collaborator

If you think that my answer helped you, can you please mark it as accepted? Thank you!

Don't have an account?