Member since
07-14-2016
215
Posts
45
Kudos Received
16
Solutions
My Accepted Solutions
Title | Views | Posted |
---|---|---|
2199 | 12-13-2018 05:01 PM | |
4942 | 09-07-2018 06:12 AM | |
2062 | 08-02-2018 07:04 AM | |
2258 | 03-26-2018 07:38 AM | |
1440 | 12-06-2017 07:53 AM |
06-08-2017
03:54 PM
After making the config changes, have you restarted both Metron REST and Metron Management UI services?
... View more
06-08-2017
08:50 AM
Hi @Lee Adrian, you need to setup your snort to output CSV alerts and then push those into the snort kafka topic. The parser reconfiguration should not be necessary. See this link on how to configure snort to output alert_csv. Can you give this a try and let me know how it goes ?
... View more
06-07-2017
11:20 AM
@Vijay Kumar - if you found my answer to have solved your problem, would you mind accepting it?
... View more
06-07-2017
09:52 AM
Can you paste the error that you are seeing now? I am assuming you have restarted the snort topology.
... View more
06-07-2017
09:20 AM
Hi @Lee Adrian, can you check that you have re-configured your snort system to include year in the timestamp? This error could be the reason. Check the Note section in this link - https://docs.hortonworks.com/HDPDocuments/HCP1/HCP-1.1.0/bk_administration/content/supported_datasources.html
... View more
06-06-2017
02:57 PM
Hey @Nilesh Shaikh, can you tell me the error you are seeing when the Metron REST service fails to start? (You can see the error log by clicking on 'ops' in the Ambari UI, and then drilling down into the operation). I have earlier built Metron 0.4.0 on a 12-node openstack environment using Ambari + Mpack installation and was able to get both Metron REST and the Management UI working successfully. These were the parameters I specified when installing the Metron service (under Advanced -> Advanced metron-env) Metron JDBC Driver = org.h2.Driver
Metron JDBC password = root
Metron JDBC platform = h2
Metron JDBC URL = jdbc:h2:file:~/metrondb
Metron JDBC username = root
Active Spring profiles = dev On your environment, can you check the values of the above config parameters and then try restarting the service to see if it works?
... View more
06-06-2017
05:31 AM
1 Kudo
Hey @Nilesh Shaikh, you will need to setup Spring Security and build the user credentials for Metron REST service,a s documented here. As a quick workaround, you can try the following: a) Login to Ambari UI -> Metron -> Configs -> Advanced -> Advanced metron-env. And ensure that the "Active Spring profiles" parameter is set to the value "dev". Then restart Metron REST service. b) Now, you can fire up the Metron Management UI (http://node1:4200) and use the credentials "admin/password". HTH, Anand
... View more
06-05-2017
05:42 AM
1 Kudo
Hello @Vijay Kumar, you will need to setup Spring Security and build the user credentials for Metron REST service,a s documented here. As a quick workaround, you can try the following: a) Login to Ambari UI -> Metron -> Configs -> Advanced -> Advanced metron-env. And ensure that the "Active Spring profiles" parameter is set to the value "dev". Then restart Metron REST service. b) Now, you can fire up the Metron Management UI (http://node1:4200) and use the credentials "admin/password". HTH, Anand
... View more
05-18-2017
11:28 AM
Is your issue resolved?
... View more
05-12-2017
02:28 PM
Hello @Sara Alizadeh, can you paste the output of metron-deployment/scripts/platform-info.sh ?
... View more
04-26-2017
12:26 PM
Thank you @Simon Elliston Ball, I have made some more edits as well to the screenshots.
... View more
04-26-2017
12:26 PM
4 Kudos
Note: This article is an extension of the instructions at this link. This article uses the example of a 12-node CentOS 7 VM cluster on Openstack environment and with HDP 2.5 as base stack for Metron ver > 0.3.x (or HDP 2.4 for Metron < 0.2.x). Please be aware that Metron deployment using Ambari management packs is actively being enhanced and worked upon. Some of the steps in this article and/or the behavior might be altered or become obsolete. Refer to this link for the current set of limitations with the Ambari Mpack installation and setup. The selection of nodes, services, slaves and clients in the Ambari cluster wizard are an indicative example. Optimization for performance and scale requirements are out of scope of this article. Prerequisites For Generating RPMs and Management Pack Local system (Mac or Linux) with build tools installed viz. Maven and docker. Refer here for more details on the tool pre-requisites. Docker service has been installed and is running. A cloned copy of the Metron git repo. For Metron Cluster deployment 12 VMs running CentOS 7.x. JDK > 1.8.x installed on all nodes. Ambari Server > 2.4.2.x required Step 1 - Build Metron RPMs and Management Pack In this step, you will create the RPMs and Ambari management pack tarball on your local system. The RPMs and Ambari mpack need to be SCP'ed into the cluster hosts a) Build Mpack On your local system where you have cloned the Git repo, run the following command: cd incubator-metron
mvn clean package -DskipTests Once the above command has run successfully, the metron management pack will be generated in the path at: incubator-metron/metron-deployment/packaging/ambari/metron-mpack/target/metron_mpack-xxxx.tar.gz b) Build RPMs Run the following commands to generate the RPMs: Note: Docker service should be running in order for the below command to work properly. cd incubator-metron/metron-deployment/
mvn clean package -Pbuild-rpms -DskipTests The above command will build the RPMs and create them under incubator-metron/metron-deployment/packaging/docker/rpm-docker/RPMS/noarch c) Copy RPMs and Mpack to cluster nodes Use either SCP or your favorite file transfer application to copy the mpack and RPMs over the to the cluster Copy the metron_mpack-xxxx.tar.gz file to the node which is going to run Ambari Server (For E.g. node #1) On the node where you would like to install Metron (For e.g. node 12), create a directory call /localrepo and scp all of the generated metron rpms to the /localrepo folder Step 2 - Install Ambari Server and Metron management pack SSH to the node where Ambari server needs to be installed (node #1) and follow these steps. Ensure CentOS repo for Ambari server is updated: wget -nv http://public-repo-1.hortonworks.com/ambari/centos7/2.x/updates/2.4.2.0/ambari.repo -O /etc/yum.repos.d/ambari.repo Install Ambari server, install mpack and start service yum install ambari-server -y
ambari-server setup -s
ambari-server install-mpack --mpack=/path/to/metron_mpack-1.0.0.0-SNAPSHOT.tar.gz --verbose
ambari-server start Step 3 - Cluster Installation Point your browser to http://<node#1>:8080 to start the cluster installation wizard. Follow the screenshots below to complete the Metron installation. Start the wizard by choosing the "Create a Cluster" option and specify a name for the cluster. Select HDP 2.5 stack for Metron 0.3.x from the version selection page. Specify the list of hosts in your cluster along with the connection information (e.g. private key) In the "Choose Services" page, select the following services -- which are required as a minimum for a working Metron deployment. You may select other additional services as per your need. HDFS YARN + MapReduce2 HBase HIVE Pig Zookeeper Storm Spark Kafka Zeppelin Elasticsearch Kibana Metron Slider Here are sample screenshots: In the "Assign Masters" page, ensure the following criteria is met. Observe that the Ambari wizard will display warning / error popups when the below criteria is not met. a) Ensure that the Kibana Server, Metron Enrichment, Metron Indexing and Metron Parsers components are all assigned to the _same node_. It is important to note that these _should not_ be on the same node as Ambari server. All of these, for e.g. could reside on the node #12 b) It is preferred to run the Elasticsearch Master on the same node as Metron components (node #12, in this example). c) Add up to 4 Kafka Broker components. Ensure that one of the Kafka Broker components is installed on the Metron node #12. d) [Optional] You may retain the Zookeeper server on only one host and remove the rest The other components may be left at their defaults Note: For some of the components, there is a warning message to remind the user for client selection. Choose "Continue Anyway" if the Validation Issues warning dialog pops up. In the "Assign Slaves and Clients" window, you need to ensure that the Metron node (#12 in this example) is selected for the following: DataNode NodeManager RegionServer Supervisor Flume ElasticsearchDataNode Client Optionally, you can choose to install "Client" on all the nodes. In the "Customize Services" window, refer to the screenshots below for filling in the respective tabs 1. Change NameNode heap size from the default 1024 MB to about 4096 MB 2. Under Elasticsearch -> Advanced elastic-site -> zen_discovery_ping_unicast_hosts, specify the location where Elasticsearch master is installed (E.g. node #12 in this case. 3. Under Kibana -> Advanced kibana-env, specify the kibana_es_url to the Elasticsearch master node URL with port as 9200. 4. Under Metron, change the parameters in the respective tabs below. Tab #1 - Default Settings for Metron services. Provide details of the Elasticsearch hosts. Tab #2 - Repository settings - Remote vs. Local repository If you choose to install using a Local repository, ensure that you have copied the Metron RPMs into the /localrepo folder in the Metron node. If you choose to install using a remote repository, specify the URL where the repo file is available. Hit the "Next" button and then hit the "Deploy" button to proceed with Metron deployment. This will start the cluster deployment and in time, all the services should be up and running.
... View more
- Find more articles tagged with:
- ambari-server
- CyberSecurity
- Deployment
- How-ToTutorial
- Metron
Labels:
04-10-2017
11:41 AM
Hi @Lee Adrian, have you setup your YAF environment as per this link - https://tools.netsa.cert.org/yaf/ ?
... View more
04-07-2017
09:53 AM
Hi @Lee Adrian, yes I have also seen that the default dashboard comes up empty unlike the quickdev/fulldev deployments. You will need to create the visualizations, indices etc. manually. One alternative that I follow is to export the entire dashboard from a quickdev/fulldev, import it into the new cluster, then edit the dashboard configuration. I'm attaching the sample export from fulldev deployment for your reference (fulldev-kibana-exportjson.txt).
... View more
03-31-2017
06:00 AM
That's great, @Lee Adrian! You're welcome!
... View more
03-30-2017
10:31 AM
If you think that my answer helped you, can you please mark it as accepted? Thank you!
... View more
03-30-2017
10:30 AM
1 Kudo
Hi @Lee Adrian, Metron uses a BasicBroParser and hence you dont see a pattern for bro. As you can see from the output below for bro and squid: [root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/bro.json
{
"parserClassName":"org.apache.metron.parsers.bro.BasicBroParser",
"sensorTopic":"bro",
"parserConfig": {}
}
[root@node1 ~]# cat /usr/metron/0.3.1/config/zookeeper/parsers/squid.json
{
"parserClassName": "org.apache.metron.parsers.GrokParser",
"sensorTopic": "squid",
"parserConfig": {
"grokPath": "/patterns/squid",
"patternLabel": "SQUID_DELIMITED",
"timestampField": "timestamp"
},
"fieldTransformations" : [
{
"transformation" : "STELLAR"
,"output" : [ "full_hostname", "domain_without_subdomains" ]
,"config" : {
"full_hostname" : "URL_TO_HOST(url)"
,"domain_without_subdomains" : "DOMAIN_REMOVE_SUBDOMAINS(full_hostname)"
}
}
]
}
... View more
03-30-2017
10:24 AM
Hm.. let me try that on my setup and revert.
... View more
03-30-2017
10:23 AM
Hi HS, on my box, the permissions on the HDFS folder /apps/metron/indexing/indexed are metron:metron. Can you check if yours is the same?
... View more
03-28-2017
09:21 AM
Hello H S, In your Grok pattern, can you try with escaping the curly braces after and before the GREEDYDATA You could copy-paste the one below: MY_TELEMETRY_SOURCE_DELIMITED %{GREEDYDATA:UNWANTED}\{"hostname":"%{HOSTNAME:hostname}","timestamp":"%{NUMBER:timestamp}","cpu_user":"%{NUMBER:cpu_user}","cpu_sys":"%{NUMBER:cpu_sys}","cpu_nice":"%{NUMBER:cpu_nice}","cpu_idle":"%{NUMBER:cpu_idle}","cpu_wait":"%{NUMBER:cpu_wait}","cpu_irq":"%{NUMBER:cpu_irq}","cpu_soft_irq":"%{NUMBER:cpu_soft_irq}","cpu_stolen":"%{NUMBER:cpu_stolen}","load_one":"%{NUMBER:load_one}","load_five":"%{NUMBER:load_five}","load_fifteen":"%{NUMBER:load_fifteen}"\}%{GREEDYDATA:UNWANTED}
Let me know if that works. Regards, Anand
... View more
03-27-2017
06:03 AM
Is this quick dev or full dev? Did you remember to run
mvn clean package on the top level folder?
Also, you needn't invoke the run.sh script. Just vagrant up should work.
... View more
03-21-2017
06:55 AM
Hi @Raunak Jain, you can use any OS of your choice for the vagrant setup, it should not matter .
... View more
03-16-2017
06:10 AM
HI @Lee Adrian, were you able to resolve the issue?
... View more
03-10-2017
10:09 AM
Hi @Lee Adrian, are you referring to the HCC article or the quick-dev github page? If its the former, can you tell me which step are you having trouble with?
... View more
03-09-2017
01:34 PM
1 Kudo
Hi @Michael Miklavcic, thanks for the article.
On my Ubuntu 14.04 openstack cluster, I was unable to start elasticsearch service after following the steps. It was failing with and error saying NoSuchFileException: /usr/share/elasticsearch/config . I had to follow the workaround in this article in order to have the services started successfully. I did not have any issues with the Kibana install. It worked fine.
... View more
03-08-2017
09:10 AM
Hi @Prasad M, sorry for the delay in responding.. Were you able to get past starting the namenode? If you're still stuck, have you tried to increase the Namenode Heap size config under HDFS -> Config in ambari? I would set this to ~5 GB when running a 12-node cluster.
... View more
03-01-2017
07:11 PM
1 Kudo
Hello @Raunak Jain, I am hoping you have looked at the landing page for Apache Metron at https://github.com/apache/incubator-metron, which talks about the various players and the quickest way to build Metron. If you are looking to deploy a quick-dev environment of Metron on vagrant, you can follow the steps here. I would advice that you pay particular attention to the pre-requisites, since Metron is a tad bit picky with the version numbers. https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/quick-dev-platform If you would like to go with a full stack deployment using Ambari, refer to the instructions in this article: https://community.hortonworks.com/articles/60805/deploying-a-fresh-metron-cluster-using-ambari-serv.html HTH, Anand
... View more
03-01-2017
05:37 PM
I wonder if this has to do something with the folder permissions?
... View more
03-01-2017
05:30 PM
Hello @Prasad M, glad to know that you were able to proceed. Would you mind to please approve my answer if you found it helpful?
... View more
03-01-2017
07:01 AM
1 Kudo
Hello @Lee Adrian, The following article should help with deploying a Metron cluster using Ambari: https://community.hortonworks.com/articles/60805/deploying-a-fresh-metron-cluster-using-ambari-serv.html If you are looking to deploy a vagrant-based quick-dev environment, then the instructions are here: https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/quick-dev-platform
... View more
- « Previous
- Next »