| <!DOCTYPE html> |
| <!-- |
| | Generated by Apache Maven Doxia Site Renderer 1.8 from src/site/markdown/metron-deployment/ansible/roles/sensor-stubs/index.md at 2019-05-14 |
| | Rendered using Apache Maven Fluido Skin 1.7 |
| --> |
| <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> |
| <head> |
| <meta charset="UTF-8" /> |
| <meta name="viewport" content="width=device-width, initial-scale=1.0" /> |
| <meta name="Date-Revision-yyyymmdd" content="20190514" /> |
| <meta http-equiv="Content-Language" content="en" /> |
| <title>Metron – Sensor Stubs</title> |
| <link rel="stylesheet" href="../../../../css/apache-maven-fluido-1.7.min.css" /> |
| <link rel="stylesheet" href="../../../../css/site.css" /> |
| <link rel="stylesheet" href="../../../../css/print.css" media="print" /> |
| <script type="text/javascript" src="../../../../js/apache-maven-fluido-1.7.min.js"></script> |
| <script type="text/javascript"> |
| $( document ).ready( function() { $( '.carousel' ).carousel( { interval: 3500 } ) } ); |
| </script> |
| </head> |
| <body class="topBarDisabled"> |
| <div class="container-fluid"> |
| <div id="banner"> |
| <div class="pull-left"><a href="http://metron.apache.org/" id="bannerLeft"><img src="../../../../images/metron-logo.png" alt="Apache Metron" width="148px" height="48px"/></a></div> |
| <div class="pull-right"></div> |
| <div class="clear"><hr/></div> |
| </div> |
| |
| <div id="breadcrumbs"> |
| <ul class="breadcrumb"> |
| <li class=""><a href="http://www.apache.org" class="externalLink" title="Apache">Apache</a><span class="divider">/</span></li> |
| <li class=""><a href="http://metron.apache.org/" class="externalLink" title="Metron">Metron</a><span class="divider">/</span></li> |
| <li class=""><a href="../../../../index.html" title="Documentation">Documentation</a><span class="divider">/</span></li> |
| <li class="active ">Sensor Stubs</li> |
| <li id="publishDate" class="pull-right"><span class="divider">|</span> Last Published: 2019-05-14</li> |
| <li id="projectVersion" class="pull-right">Version: 0.7.1</li> |
| </ul> |
| </div> |
| <div class="row-fluid"> |
| <div id="leftColumn" class="span2"> |
| <div class="well sidebar-nav"> |
| <ul class="nav nav-list"> |
| <li class="nav-header">User Documentation</li> |
| <li><a href="../../../../index.html" title="Metron"><span class="icon-chevron-down"></span>Metron</a> |
| <ul class="nav nav-list"> |
| <li><a href="../../../../CONTRIBUTING.html" title="CONTRIBUTING"><span class="none"></span>CONTRIBUTING</a></li> |
| <li><a href="../../../../Upgrading.html" title="Upgrading"><span class="none"></span>Upgrading</a></li> |
| <li><a href="../../../../metron-analytics/index.html" title="Analytics"><span class="icon-chevron-right"></span>Analytics</a></li> |
| <li><a href="../../../../metron-contrib/metron-docker/index.html" title="Docker"><span class="none"></span>Docker</a></li> |
| <li><a href="../../../../metron-contrib/metron-performance/index.html" title="Performance"><span class="none"></span>Performance</a></li> |
| <li><a href="../../../../metron-deployment/index.html" title="Deployment"><span class="icon-chevron-down"></span>Deployment</a> |
| <ul class="nav nav-list"> |
| <li><a href="../../../../metron-deployment/Kerberos-ambari-setup.html" title="Kerberos-ambari-setup"><span class="none"></span>Kerberos-ambari-setup</a></li> |
| <li><a href="../../../../metron-deployment/Kerberos-manual-setup.html" title="Kerberos-manual-setup"><span class="none"></span>Kerberos-manual-setup</a></li> |
| <li><a href="../../../../metron-deployment/amazon-ec2/index.html" title="Amazon-ec2"><span class="none"></span>Amazon-ec2</a></li> |
| <li><a href="../../../../metron-deployment/ansible/index.html" title="Ansible"><span class="icon-chevron-down"></span>Ansible</a> |
| <ul class="nav nav-list"> |
| <li><a href="../../../../metron-deployment/ansible/roles/index.html" title="Roles"><span class="icon-chevron-down"></span>Roles</a> |
| <ul class="nav nav-list"> |
| <li><a href="../../../../metron-deployment/ansible/roles/opentaxii/index.html" title="Opentaxii"><span class="none"></span>Opentaxii</a></li> |
| <li><a href="../../../../metron-deployment/ansible/roles/pcap_replay/index.html" title="Pcap_replay"><span class="none"></span>Pcap_replay</a></li> |
| <li class="active"><a href="#"><span class="none"></span>Sensor-stubs</a></li> |
| <li><a href="../../../../metron-deployment/ansible/roles/sensor-test-mode/index.html" title="Sensor-test-mode"><span class="none"></span>Sensor-test-mode</a></li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li><a href="../../../../metron-deployment/development/index.html" title="Development"><span class="icon-chevron-right"></span>Development</a></li> |
| <li><a href="../../../../metron-deployment/other-examples/index.html" title="Other-examples"><span class="icon-chevron-right"></span>Other-examples</a></li> |
| <li><a href="../../../../metron-deployment/packaging/ambari/index.html" title="Ambari"><span class="icon-chevron-right"></span>Ambari</a></li> |
| <li><a href="../../../../metron-deployment/packaging/docker/ansible-docker/index.html" title="Ansible-docker"><span class="none"></span>Ansible-docker</a></li> |
| <li><a href="../../../../metron-deployment/packaging/docker/deb-docker/index.html" title="Deb-docker"><span class="none"></span>Deb-docker</a></li> |
| <li><a href="../../../../metron-deployment/packaging/docker/rpm-docker/index.html" title="Rpm-docker"><span class="none"></span>Rpm-docker</a></li> |
| <li><a href="../../../../metron-deployment/packaging/packer-build/index.html" title="Packer-build"><span class="none"></span>Packer-build</a></li> |
| </ul> |
| </li> |
| <li><a href="../../../../metron-interface/index.html" title="Interface"><span class="icon-chevron-right"></span>Interface</a></li> |
| <li><a href="../../../../metron-platform/index.html" title="Platform"><span class="icon-chevron-right"></span>Platform</a></li> |
| <li><a href="../../../../metron-sensors/index.html" title="Sensors"><span class="icon-chevron-right"></span>Sensors</a></li> |
| <li><a href="../../../../metron-stellar/stellar-3rd-party-example/index.html" title="Stellar-3rd-party-example"><span class="none"></span>Stellar-3rd-party-example</a></li> |
| <li><a href="../../../../metron-stellar/stellar-common/index.html" title="Stellar-common"><span class="icon-chevron-right"></span>Stellar-common</a></li> |
| <li><a href="../../../../metron-stellar/stellar-zeppelin/index.html" title="Stellar-zeppelin"><span class="none"></span>Stellar-zeppelin</a></li> |
| <li><a href="../../../../use-cases/index.html" title="Use-cases"><span class="icon-chevron-right"></span>Use-cases</a></li> |
| </ul> |
| </li> |
| </ul> |
| <hr /> |
| <div id="poweredBy"> |
| <div class="clear"></div> |
| <div class="clear"></div> |
| <div class="clear"></div> |
| <div class="clear"></div> |
| <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy"><img class="builtBy" alt="Built by Maven" src="../../../../images/logos/maven-feather.png" /></a> |
| </div> |
| </div> |
| </div> |
| <div id="bodyColumn" class="span10" > |
| <!-- |
| Licensed to the Apache Software Foundation (ASF) under one |
| or more contributor license agreements. See the NOTICE file |
| distributed with this work for additional information |
| regarding copyright ownership. The ASF licenses this file |
| to you under the Apache License, Version 2.0 (the |
| "License"); you may not use this file except in compliance |
| with the License. You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, software |
| distributed under the License is distributed on an "AS IS" BASIS, |
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| See the License for the specific language governing permissions and |
| limitations under the License. |
| --> |
| <h1>Sensor Stubs</h1> |
| <p><a name="Sensor_Stubs"></a></p> |
| <p>A service has been created to simulate the behavior of a sensor by sending canned telemetry data to a Kafka topic. These “Sensor Stubs” consume fewer resources than the actual sensor that they replace.</p> |
| <div class="section"> |
| <div class="section"> |
| <h3><a name="a.28Q.29_How_do_the_sensor_stubs_work.3F"></a>(Q) How do the sensor stubs work?</h3> |
| <p>The stubs are installed with a set of canned data for each sensor type; Bro, Snort and YAF. A subset of this canned data is randomly selected and sent to the Kafka topic in batches. The timestamp of each message is updated to match current system time.</p></div> |
| <div class="section"> |
| <h3><a name="a.28Q.29_How_do_I_configure_the_message_rate.3F"></a>(Q) How do I configure the message rate?</h3> |
| <p>The number of telemetry messages sent in each batch, along with the time delay between batches is configurable. Before installation, these values can be configured by redefining <tt>sensor_stubs_delay</tt> and <tt>sensor_stubs_count</tt>. The values can also be configured by altering the deployed system service script at <tt>/etc/init.d/sensor-stubs</tt>.</p></div> |
| <div class="section"> |
| <h3><a name="a.28Q.29_How_do_I_install_the_sensor_stubs.3F"></a>(Q) How do I install the sensor stubs?</h3> |
| <p>Using the default playbooks, this role can be installed by using the Ansible tag <tt>sensor-stubs</tt>. This service is installed on the same hosts where the sensors would be; defined by the <tt>sensors</tt> host group.</p> |
| <p>The defaults for the “Full Dev” environment have been changed so that the Sensor Stubs are installed by default, rather than the sensors themselves. The Amazon EC2 environment continues to install the original sensors by default.</p></div> |
| <div class="section"> |
| <h3><a name="a.28Q.29_How_do_I_use_the_sensor_stubs.3F"></a>(Q) How do I use the sensor stubs?</h3> |
| <p>Start all sensor stubs. The output includes the PID for each running sensor stub.</p> |
| |
| <div> |
| <div> |
| <pre class="source">$ service sensor-stubs start |
| Starting sensor-stubs... |
| bro: Ok [26505] |
| yaf: Ok [26507] |
| snort: Ok [26509] |
| </pre></div></div> |
| |
| <p>Check the status of each sensor stub.</p> |
| |
| <div> |
| <div> |
| <pre class="source">$ service sensor-stubs status |
| Checking sensor-stubs... |
| bro: Running [26505] |
| yaf: Running [26507] |
| snort: Running [26509] |
| </pre></div></div> |
| |
| <p>Stop all sensor stubs.</p> |
| |
| <div> |
| <div> |
| <pre class="source">$ service sensor-stubs stop |
| Stopping sensor-stubs... |
| .. bro: Ok [26505] |
| .. yaf: Ok [26507] |
| .. snort: Ok [26509] |
| </pre></div></div> |
| |
| <p>Check the status. All sensor stubs should be stopped.</p> |
| |
| <div> |
| <div> |
| <pre class="source">$ service sensor-stubs status |
| Checking sensor-stubs... |
| bro: Not running |
| yaf: Not running |
| snort: Not running |
| </pre></div></div> |
| |
| <p>Start only the Bro sensor stub.</p> |
| |
| <div> |
| <div> |
| <pre class="source">$ service sensor-stubs start bro |
| Starting sensor-stubs... |
| bro: OK [11616] |
| </pre></div></div> |
| |
| <p>Stop the Bro sensor stub.</p> |
| |
| <div> |
| <div> |
| <pre class="source">$ service sensor-stubs stop bro |
| Stopping sensor-stubs... |
| .. bro: Ok [11616] |
| </pre></div></div> |
| </div> |
| <div class="section"> |
| <h3><a name="a.28Q.29_How_do_I_install_the_original_sensors.3F"></a>(Q) How do I install the original sensors?</h3> |
| <p>The default behavior can be changed by skipping the <tt>sensor-stubs</tt> flag and including the <tt>sensors</tt> flag. For example, to deploy “Full Dev” with the original sensors run the following command.</p> |
| |
| <div> |
| <div> |
| <pre class="source">cd metron-deployment/development/centos6 |
| vagrant --ansible-skip-tags="sensor-stubs,solr" up |
| </pre></div></div> |
| </div> |
| <div class="section"> |
| <h3><a name="a.28Q.29_Where_does_the_mock_data_come_from.3F"></a>(Q) Where does the mock data come from?</h3> |
| <p>The data produced by the sensor stubs was generated by running the sensors against the example pcap file that is distributed with Metron. This ensures that the data produced by the sensor stubs is similar to the data produced when using the actual sensors.</p></div></div> |
| </div> |
| </div> |
| </div> |
| <hr/> |
| <footer> |
| <div class="container-fluid"> |
| <div class="row-fluid"> |
| © 2015-2016 The Apache Software Foundation. Apache Metron, Metron, Apache, the Apache feather logo, |
| and the Apache Metron project logo are trademarks of The Apache Software Foundation. |
| </div> |
| </div> |
| </footer> |
| </body> |
| </html> |
