Re: Question on Windows event log ingest and parse

2017-05-03 Thread Simon Elliston Ball 
And just to check… you have the pattern definition you previously sent in 
/patterns/winlogbeat (file) on HDFS.

It looks like the most likely problem from your config is that you have two 
parserConfig elements. I suspect the second is over-riding the first, and hence 
you are losing the grokPath config, if you move the dc2tz element into the 
first parserConfig, you should be good.

As an aside from a quick look at your pattern, it looks like it may be easier 
to use the JSONMapParser for this particular sensor. 

Simon

> On 4 May 2017, at 01:28, ed d  wrote:
> 
> Correction, deploying the Storm topology is this:
> 
> /usr/metron/$METRON_VERSION/bin/start_parser_topology.sh -z `hostname 
> -f`:2181 -k `hostname -f`:6667 -s winlogbeat
> 
> 
> 
> 
> 
> From: Simon Elliston Ball 
> Sent: Wednesday, May 3, 2017 5:59 PM
> To: user@metron.apache.org
> Subject: Re: Question on Windows event log ingest and parse
>  
> Hi Ed, 
> 
> Sounds like a really nice piece of work to get pushed into the core… how 
> would you feel about taking that grok parser and formalising it into the core 
> of Metron (happy to help there by the way).
> 
> On the actual issue, is sounds like it’s likely to be something to do with 
> conversion of the timestamp format to the unixtime used in Metron. We can 
> look at that. Did you see any log messages in the storm logs from the 
> topology that died? 
> 
> Simon
> 
> 
>> On 3 May 2017, at 22:34, ed d > > wrote:
>> 
>> Metron version – 0.4.0
>> Single node install, bare metal install
>> No significant changes to base install besides maintenance mode on 
>> elasticsearch mpack and manual configuration.
>>  
>> I have a Windows 2012 server running AD, AD LDS, DNS, and DHCP. I installed 
>> Winlogbeat 5.3.2 64 bit 
>> onto the server. It was configured to push logs to the Elasticsearch on my 
>> Metron install, and it works great. No issues.
>>  
>> I modified the Winlogbeat configuration to push logs directly to Kafka as I 
>> want to enrich the logs. I followed this guide 
>> .
>>  
>> I can see logs coming into the Kafka topic, so I built a Grok parser to 
>> slice and dice. It seems to work fine on Grok Constructor 
>>  and Grok Debugger 
>> , but when I load it into Metron as a 
>> parser, it kills the Storm topology. It seems to be sticking on the 
>> timestamp, which is ISO_8601  format 
>> (2017-05-03T21:04:33Z).
>>  
>> My question to the group, before troubleshooting my install, is to see if 
>> anyone else has had success ingesting and parsing Windows event logs?
>>  
>> Does anyone pull Windows log into Kafka, Nifi, or other with the intent to 
>> enrich the elements of the log? And if yes, what have you found to be most 
>> useful?
>>  
>> FYI here is my Grok parser for reference:
>>  
>>

Re: Question on Windows event log ingest and parse

2017-05-03 Thread ed d 
Correction, deploying the Storm topology is this:


/usr/metron/$METRON_VERSION/bin/start_parser_topology.sh -z `hostname -f`:2181 
-k `hostname -f`:6667 -s winlogbeat






From: Simon Elliston Ball 
Sent: Wednesday, May 3, 2017 5:59 PM
To: user@metron.apache.org
Subject: Re: Question on Windows event log ingest and parse

Hi Ed,

Sounds like a really nice piece of work to get pushed into the core… how would 
you feel about taking that grok parser and formalising it into the core of 
Metron (happy to help there by the way).

On the actual issue, is sounds like it’s likely to be something to do with 
conversion of the timestamp format to the unixtime used in Metron. We can look 
at that. Did you see any log messages in the storm logs from the topology that 
died?

Simon


On 3 May 2017, at 22:34, ed d 
> wrote:


Metron version – 0.4.0
Single node install, bare metal install
No significant changes to base install besides maintenance mode on 
elasticsearch mpack and manual configuration.

I have a Windows 2012 server running AD, AD LDS, DNS, and DHCP. I installed 
Winlogbeat5.3.2 64 bit onto 
the server. It was configured to push logs to the Elasticsearch on my Metron 
install, and it works great. No issues.

I modified the Winlogbeat configuration to push logs directly to Kafka as I 
want to enrich the logs. I followed this 
guide.

I can see logs coming into the Kafka topic, so I built a Grok parser to slice 
and dice. It seems to work fine on Grok 
Constructor and Grok 
Debugger, but when I load it into Metron as a 
parser, it kills the Storm topology. It seems to be sticking on the timestamp, 
which is ISO_8601 format 
(2017-05-03T21:04:33Z).

My question to the group, before troubleshooting my install, is to see if 
anyone else has had success ingesting and parsing Windows event logs?

Does anyone pull Windows log into Kafka, Nifi, or other with the intent to 
enrich the elements of the log? And if yes, what have you found to be most 
useful?

FYI here is my Grok parser for reference:

timestamp"\:"%{TIMESTAMP_ISO8601:timestamp}","beat"\:\{"hostname"\:%{QUOTEDSTRING:hostname},"name"\:%{QUOTEDSTRING:name},"version"\:%{QUOTEDSTRING:beat_version}\},"computer_name"\:%{QUOTEDSTRING:computer_name},"event_data"\:\{("AuthenticationPackageName"\:%{QUOTEDSTRING:AuthenticationPackageName},?)?("ImpersonationLevel"\:%{QUOTEDSTRING:ImpersonationLevel},?)?("FailureReason"\:%{QUOTEDSTRING:FailureReason},?)?("IpAddress"\:"%{IP:ip_src_addr}",?)?("IpPort"\:%{QUOTEDSTRING:IpPort},?)?("KeyLength"\:%{QUOTEDSTRING:KeyLength},?)?("LmPackageName"\:%{QUOTEDSTRING:LmPackageName},?)?("LogonGuid"\:%{QUOTEDSTRING:LogonGuid},?)?("LogonProcessName"\:%{QUOTEDSTRING:LogonProcessName},?)?("LogonType"\:%{QUOTEDSTRING:LogonType},?)?("PrivilegeList"\:%{QUOTEDSTRING:PrivilegeList},?)?("ProcessId"\:%{QUOTEDSTRING:ProcessId},?)?("ProcessName"\:%{QUOTEDSTRING:ProcessName},?)?("PackageName"\:%{QUOTEDSTRING:PackageName},?)?("Status"\:%{QUOTEDSTRING:Status},?)?("SubStatus"\:%{QUOTEDSTRING:SubStatus},?)?("SubjectDomainName"\:%{QUOTEDSTRING:SubjectDomainName},?)?("SubjectLogonId"\:%{QUOTEDSTRING:SubjectLogonId},?)?("SubjectUserName"\:%{QUOTEDSTRING:SubjectUserName},?)?("SubjectUserSid"\:%{QUOTEDSTRING:SubjectUserSid},?)?("TargetDomainName"\:%{QUOTEDSTRING:TargetDomainName},?)?("TargetLogonId"\:%{QUOTEDSTRING:TargetLogonId},?)?("TargetUserName"\:%{QUOTEDSTRING:TargetUserName},?)?("TargetUserSid"\:%{QUOTEDSTRING:TargetUserSid},?)?("TransmittedServices"\:%{QUOTEDSTRING:TransmittedServices},?)?("Workstation"\:%{QUOTEDSTRING:Workstation},?)?("WorkstationName"\:%{QUOTEDSTRING:WorkstationName},?)?\},"event_id"\:%{NUMBER:event_id},"keywords"\:\[%{QUOTEDSTRING:keywords}\],"level"\:%{QUOTEDSTRING:level},"log_name"\:%{QUOTEDSTRING:log_name},"message"\:%{QUOTEDSTRING:message},"opcode"\:%{QUOTEDSTRING:opcode},"process_id"\:%{NUMBER:process_id},"provider_guid"\:%{QUOTEDSTRING:provider_guid},"record_number"\:%{QUOTEDSTRING:record_number},"source_name"\:%{QUOTEDSTRING:source_name},"task"\:%{QUOTEDSTRING:task},"thread_id"\:%{NUMBER:thread_id},"type"\:%{QUOTEDSTRING:type},?("version"\:%{NUMBER:version},?)?\}

unsubscribe

2017-05-03 Thread Figueroa Luis 

Luis Figueroa
Solutions Engineer
lfigue...@hortonworks.com
954.298.1144

Re: Unable to build Metron, stuck at rpm-docker

2017-05-03 Thread Laurens Vets 

I "fixed" it by disabling selinux...

On 2017-05-03 08:33, Laurens Vets wrote:

Hi List,

I'm following this guide:
https://cwiki.apache.org/confluence/display/METRON/Metron+with+HDP+2.5+bare-metal+install
and Maven seems to fail after this:
"cd metron-deployment/packaging/docker/rpm-docker"
"mvn clean install -DskipTests -PHDP-2.5.0.0"

Removing intermediate container 8644c929ac36
Successfully built 7147787972fc
[INFO]
[INFO] --- exec-maven-plugin:1.5.0:exec (rpm-build) @ metron-rpm ---
/bin/bash: ./build.sh: Permission denied
[ERROR] Command execution failed.
org.apache.commons.exec.ExecuteException: Process exited with an
error: 126 (Exit value: 126)
at
org.apache.commons.exec.DefaultExecutor.executeInternal(DefaultExecutor.java:404)
at
org.apache.commons.exec.DefaultExecutor.execute(DefaultExecutor.java:166)
at 
org.codehaus.mojo.exec.ExecMojo.executeCommandLine(ExecMojo.java:764)
at 
org.codehaus.mojo.exec.ExecMojo.executeCommandLine(ExecMojo.java:711)

at org.codehaus.mojo.exec.ExecMojo.execute(ExecMojo.java:289)
at
org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:134)
at
org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:207)
at
org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
at
org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
at
org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:116)
at
org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:80)
at
org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:51)
at
org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
at 
org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:307)
at 
org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:193)

at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:106)
at org.apache.maven.cli.MavenCli.execute(MavenCli.java:863)
at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main(MavenCli.java:199)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
at
org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
at
org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:415)
at
org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:356)
[INFO] 


[INFO] BUILD FAILURE
[INFO] 


[INFO] Total time: 05:13 min
[INFO] Finished at: 2017-05-03T07:48:12-07:00
[INFO] Final Memory: 12M/155M
[INFO] 


[ERROR] Failed to execute goal
org.codehaus.mojo:exec-maven-plugin:1.5.0:exec (rpm-build) on project
metron-rpm: Command
 execution failed. Process exited with an error: 126 (Exit value: 126)
-> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with
the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions,
please read the following articles:
[ERROR] [Help 1]
http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[root@metron1 rpm-docker]#

I don't know why build.sh would give a permission denied:

[root@metron1 rpm-docker]# ls -altr
total 36
drwxr-xr-x. 2 root root25 May  2 14:35 SPECS
-rw-r--r--. 1 root root   449 May  2 14:35 README.md
-rw-r--r--. 1 root root 14915 May  2 14:35 pom.xml
-rw-r--r--. 1 root root40 May  2 14:35 .gitignore
-rw-r--r--. 1 root root  1268 May  2 14:35 Dockerfile
-rwxr-xr-x. 1 root root  1965 May  2 14:35 build.sh
drwxr-xr-x. 4 root root46 May  2 14:35 ..
drwxr-xr-x. 4 root root   118 May  3 07:43 .
drwxr-xr-x. 2 root root  4096 May  3 07:43 SOURCES
[root@metron1 rpm-docker]#

Any ideas?

Re: Unable to build Metron, stuck at rpm-docker

2017-05-03 Thread Nick Allen 
Did the command before that one run successfully?  The one that looks like
the following.

cd incubator-metron
mvn clean install -DskipTests -PHDP-2.5.0.0


I don't think you need to run the command that is failing you at all.  I
would think you already have the RPMs built.

Can you run a command like the following and see if you already have RPMs
built?  If you do, it will look something like this.

nallen@HW12402 : ~/Development/incubator-metron
$ find ./ -name "*.rpm"
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-common-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-config-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-data-management-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-elasticsearch-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-enrichment-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-indexing-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-parsers-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-pcap-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-profiler-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/RPMS/noarch/metron-solr-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/SRPMS/metron-0.4.0-201705031846.src.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-common-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-config-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-data-management-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-elasticsearch-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-enrichment-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-indexing-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-parsers-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-pcap-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-profiler-0.4.0-201705031846.noarch.rpm
.//metron-deployment/packaging/docker/rpm-docker/target/RPMS/noarch/metron-solr-0.4.0-201705031846.noarch.rpm

If you do, then just skip the command that is failing you and continue on
in the instructions.  We might need to update the Wiki instructions.


On Wed, May 3, 2017 at 11:33 AM, Laurens Vets  wrote:

> Hi List,
>
> I'm following this guide: https://cwiki.apache.org/confl
> uence/display/METRON/Metron+with+HDP+2.5+bare-metal+install and Maven
> seems to fail after this:
> "cd metron-deployment/packaging/docker/rpm-docker"
> "mvn clean install -DskipTests -PHDP-2.5.0.0"
>
> Removing intermediate container 8644c929ac36
> Successfully built 7147787972fc
> [INFO]
> [INFO] --- exec-maven-plugin:1.5.0:exec (rpm-build) @ metron-rpm ---
> /bin/bash: ./build.sh: Permission denied
> [ERROR] Command execution failed.
> org.apache.commons.exec.ExecuteException: Process exited with an error:
> 126 (Exit value: 126)
> at org.apache.commons.exec.DefaultExecutor.executeInternal(Defa
> ultExecutor.java:404)
> at org.apache.commons.exec.DefaultExecutor.execute(DefaultExecu
> tor.java:166)
> at org.codehaus.mojo.exec.ExecMojo.executeCommandLine(ExecMojo.
> java:764)
> at org.codehaus.mojo.exec.ExecMojo.executeCommandLine(ExecMojo.
> java:711)
> at org.codehaus.mojo.exec.ExecMojo.execute(ExecMojo.java:289)
> at org.apache.maven.plugin.DefaultBuildPluginManager.executeMoj
> o(DefaultBuildPluginManager.java:134)
> at org.apache.maven.lifecycle.internal.MojoExecutor.execute(Moj
> oExecutor.java:207)
> at org.apache.maven.lifecycle.internal.MojoExecutor.execute(Moj
> oExecutor.java:153)
> at org.apache.maven.lifecycle.internal.MojoExecutor.execute(Moj
> oExecutor.java:145)
> at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.b
> uildProject(LifecycleModuleBuilder.java:116)
> at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.b
> uildProject(LifecycleModuleBuilder.java:80)
> at org.apache.maven.lifecycle.internal.builder.singlethreaded.S
> ingleThreadedBuilder.build(SingleThreadedBuilder.java:51)
> at org.apache.maven.lifecycle.internal.LifecycleStarter.execute
> (LifecycleStarter.java:128)
> at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:307)

Unable to build Metron, stuck at rpm-docker

2017-05-03 Thread Laurens Vets 

Hi List,

I'm following this guide: 
https://cwiki.apache.org/confluence/display/METRON/Metron+with+HDP+2.5+bare-metal+install 
and Maven seems to fail after this:

"cd metron-deployment/packaging/docker/rpm-docker"
"mvn clean install -DskipTests -PHDP-2.5.0.0"

Removing intermediate container 8644c929ac36
Successfully built 7147787972fc
[INFO]
[INFO] --- exec-maven-plugin:1.5.0:exec (rpm-build) @ metron-rpm ---
/bin/bash: ./build.sh: Permission denied
[ERROR] Command execution failed.
org.apache.commons.exec.ExecuteException: Process exited with an error: 
126 (Exit value: 126)
at 
org.apache.commons.exec.DefaultExecutor.executeInternal(DefaultExecutor.java:404)
at 
org.apache.commons.exec.DefaultExecutor.execute(DefaultExecutor.java:166)
at 
org.codehaus.mojo.exec.ExecMojo.executeCommandLine(ExecMojo.java:764)
at 
org.codehaus.mojo.exec.ExecMojo.executeCommandLine(ExecMojo.java:711)

at org.codehaus.mojo.exec.ExecMojo.execute(ExecMojo.java:289)
at 
org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:134)
at 
org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:207)
at 
org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
at 
org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
at 
org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:116)
at 
org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:80)
at 
org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:51)
at 
org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
at 
org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:307)
at 
org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:193)

at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:106)
at org.apache.maven.cli.MavenCli.execute(MavenCli.java:863)
at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main(MavenCli.java:199)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)
at 
org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
at 
org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
at 
org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:415)
at 
org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:356)
[INFO] 


[INFO] BUILD FAILURE
[INFO] 


[INFO] Total time: 05:13 min
[INFO] Finished at: 2017-05-03T07:48:12-07:00
[INFO] Final Memory: 12M/155M
[INFO] 

[ERROR] Failed to execute goal 
org.codehaus.mojo:exec-maven-plugin:1.5.0:exec (rpm-build) on project 
metron-rpm: Command
 execution failed. Process exited with an error: 126 (Exit value: 126) 
-> [Help 1]

[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the 
-e switch.

[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, 
please read the following articles:
[ERROR] [Help 1] 
http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException

[root@metron1 rpm-docker]#

I don't know why build.sh would give a permission denied:

[root@metron1 rpm-docker]# ls -altr
total 36
drwxr-xr-x. 2 root root25 May  2 14:35 SPECS
-rw-r--r--. 1 root root   449 May  2 14:35 README.md
-rw-r--r--. 1 root root 14915 May  2 14:35 pom.xml
-rw-r--r--. 1 root root40 May  2 14:35 .gitignore
-rw-r--r--. 1 root root  1268 May  2 14:35 Dockerfile
-rwxr-xr-x. 1 root root  1965 May  2 14:35 build.sh
drwxr-xr-x. 4 root root46 May  2 14:35 ..
drwxr-xr-x. 4 root root   118 May  3 07:43 .
drwxr-xr-x. 2 root root  4096 May  3 07:43 SOURCES
[root@metron1 rpm-docker]#

Any ideas?