Re: Unable to load Custom Stellar functions from HDFS

2019-04-08 Thread Athul Parambath
Hi Michael, Thanks for your reply. Please find the attached global.json files. global.json - we have pointed to active namenode. It's working fine, global_with_HA_name - We used namenode HA name to access the HDFS location, and it throws an exception, details are added in my previous mail.

Re: Load_tool.sh issues

2019-04-08 Thread James Meyer
unsubscribe On Tue, 9 Apr 2019 at 02:39, Thiago Rahal Disposti wrote: > Hello all, How's it going? > > We've been seeing an issue with load_tool.sh (which we use to collect our > topics EPS): > > After a few months running every 15min on the servers, it just > stopped working, like this: > >

Re: Load_tool.sh issues

2019-04-08 Thread Michael Miklavcic
For starters, can you elaborate on this a bit? "After a few months running every 15min on the servers, it just stopped working, like this" You had an automated 15-min test that was running fine for months and just stopped working...? Am I interpreting that correctly, and any upgrades in that time?

Load_tool.sh issues

2019-04-08 Thread Thiago Rahal Disposti
Hello all, How's it going? We've been seeing an issue with load_tool.sh (which we use to collect our topics EPS): After a few months running every 15min on the servers, it just stopped working, like this: [image: image.png] It does not write anything else after those messages After a little

RE: Metron concept

2019-04-08 Thread stephane.davy
Well, I realize that the console-consumer works with the—zookeeper option, which is the “old consumer”, while it doesn’t work when I specify –bootstrap-server, which is the “new consumer” way. So, it looks like a Kafka issue… From: DAVY Stephane OBS/CSO Sent: Monday, April 08, 2019 16:45 To:

Re: Metron concept

2019-04-08 Thread Simon Elliston Ball
Are you seeing events on the enrichments topic, and if so, are they getting to indexing? Any messages in the storm logs for these topologies? Are you also certain the parser is correct, and there are no invalid or error messages being sent to the error index? Simon On Mon, 8 Apr 2019 at 15:26,

RE: Metron concept

2019-04-08 Thread stephane.davy
Hello Nick, Thanks for your answer. I went through this post and see that all my events should go in Elastic, which is what I want, but which it isn’t what I get ☹ I have setup the following basic setup: - New telemetry with grok parser (validated in UI with sample) and a kafka topic

Re: Snort logs flow issue

2019-04-08 Thread Michael Miklavcic
If you see them in the dashboard you should be able to see them in the alerts UI. Any errors in either the alerts UI or REST logs? Also, the new default behavior is that the UI doesn't initiate a search at login, it's up to the user to click search. On Mon, Apr 8, 2019, 6:38 AM Hema malini

Re: Unable to load Custom Stellar functions from HDFS

2019-04-08 Thread Michael Miklavcic
Hi Athul, Can you post your global.json? On Fri, Mar 29, 2019 at 8:38 AM Athul Parambath wrote: > Hi Team, > > > > We have HCP cluster installed along with HDP and here is the stack > versions: > > Ambari-2.6.2.2 > HDP-2.6.5.0 > HCP-1.8.0.0(Which includes Apache metron-0.7.0) > > > We are

Re: Metron concept

2019-04-08 Thread Nick Allen
All events are indexed by default. See if this guide helps you any. https://cwiki.apache.org/confluence/display/METRON/Adding+a+New+Telemetry+Data+Source On Mon, Apr 8, 2019 at 2:49 AM wrote: > Hello all, > > > > There is one my point that isn’t clear for me. When sending data into > Metron,

Re: Snort logs flow issue

2019-04-08 Thread Hema malini
After recreating the index, now we are able to visualize the data in kibana metron dashboard. How we can pass alerts to metron alerts UI. Currently there is no data in alerts UI. How.to configure the logs as alerts On Sat, Apr 6, 2019, 9:21 PM Hema malini wrote: > Sorry for the typo. Can you

Metron concept

2019-04-08 Thread stephane.davy
Hello all, There is one my point that isn't clear for me. When sending data into Metron, are all the events all indexed sent to Elastic and / or HDFS, or only the events that trigger a triage rule? For now I'm trying to send some FW logs in Metron, I feed a Kafka topic with Nifi, I can see