[GitHub] incubator-metron pull request #170: METRON-253: Reloading parser configurati...

[cestella]

GitHub user cestella opened a pull request:

https://github.com/apache/incubator-metron/pull/170

METRON-253: Reloading parser configurations from zookeeper doesn't call 
init()

This results in a NPE if you do not specify an output column (this output 
column gets inferred as part of init())

To validate this:
* Get a running topology
* Run `/usr/metron/0.2.0BETA/bin/zk_load_configs.sh -m PUSH -i 
/usr/metron/0.2.0BETA/config/zookeeper -z node1:2181`
* Wait a full 2 minutes
* Check the `parser_error` topic via the kafka console consumer and ensure 
you don't see any weird NPEs

The problem here is that init() is not getting run on the sensor parser 
config, so some syntactic sugar in the FieldTransformer isn't getting updated.  
Specifically, if you only specify `input` and not `output`, then it will NPE.

You can merge this pull request into a Git repository by running:

$ git pull https://github.com/cestella/incubator-metron yaf_npe

Alternatively you can review and apply these changes as the patch at:

https://github.com/apache/incubator-metron/pull/170.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

This closes #170


commit b0d391c143e3f14a16cadcac6ab91e6863b1be8d
Author: cstella 
Date:   2016-06-22T20:27:31Z

METRON-253: Reloading parser configurations from zookeeper doesn't call 
init()




---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron pull request #168: METRON-248 metron_example group_vars fil...

[asfgit]

Github user asfgit closed the pull request at:

https://github.com/apache/incubator-metron/pull/168


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron pull request #167: METRON-246 metron_streaming role needs t...

[asfgit]

Github user asfgit closed the pull request at:

https://github.com/apache/incubator-metron/pull/167


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #165: METRON-245 mysql_server role needs to explicitl...

[nickwallen]

Github user nickwallen commented on the issue:

https://github.com/apache/incubator-metron/pull/165
  
+1 Validated with Quick Dev


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #169: METRON-252 Metron Dashboard Can Be Broken By Ad...

[james-sirota]

Github user james-sirota commented on the issue:

https://github.com/apache/incubator-metron/pull/169
  
+ 1


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron pull request #169: METRON-252 Metron Dashboard Can Be Broke...

[nickwallen]

GitHub user nickwallen opened a pull request:

https://github.com/apache/incubator-metron/pull/169

METRON-252 Metron Dashboard Can Be Broken By Adding Index

[METRON-252](https://issues.apache.org/jira/browse/METRON-252)

 Problem

There are some visuals in the default dashboard that cross multiple 
indices.  The only way to do this via Kibana's web interface, is to create a 
"*" or wildcard index.  Unfortunately, this can also pull in other unrelated 
indices that could potentially impact the functioning of the dashboard.

For example, in this specific scenario an additional index was added that 
had the same field name, but a different data type than Snort, YAF, and Bro.  
This thoroughly confused Kibana and caused it to report the following error 
when viewing Metron's Dashboard.

```
Error: [unsupported_operation_exception] custom format isn't supported
```

 Solution

If you modify the JSON used to create the .kibana index manually, there is 
a way to specify multiple indexes for a visualization instead of using a 
wildcard index pattern.  Previously, there were multiple visuals with index 
references as follows.

```
{\"index\":\"*\"
```

These have all been changed to specifically reference the 3 default sensors.

```
{\"index\":[\"yaf*\", \"bro*\", \"snort*\"]
```

This ensures that no other indices can impact the default dashboard.

This was tested by deploying to an AWS cluster.  The dashboard was able to 
function in the presence of the same index that had previously broken it.

You can merge this pull request into a Git repository by running:

$ git pull https://github.com/nickwallen/incubator-metron METRON-252

Alternatively you can review and apply these changes as the patch at:

https://github.com/apache/incubator-metron/pull/169.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

This closes #169


commit 54930f0f6cbeb03ecfb88ab4c44aa3bbffa7df4e
Author: Nick Allen 
Date:   2016-06-22T19:16:26Z

METRON-252 Using index sets instead of a wildcard index for visuals that 
cross multiple indices




---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #167: METRON-246 metron_streaming role needs to expli...

[cestella]

Github user cestella commented on the issue:

https://github.com/apache/incubator-metron/pull/167
  
+1, looks good


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #166: METRON-247 Deployment fails on hosts with no 'e...

[james-sirota]

Github user james-sirota commented on the issue:

https://github.com/apache/incubator-metron/pull/166
  
+1 Ran it up on AWS 


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #167: METRON-246 metron_streaming role needs to expli...

[james-sirota]

Github user james-sirota commented on the issue:

https://github.com/apache/incubator-metron/pull/167
  
+1 Ran it up in AWS 


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #168: METRON-248 metron_example group_vars file is ou...

[james-sirota]

Github user james-sirota commented on the issue:

https://github.com/apache/incubator-metron/pull/168
  
+1 ran it up in AWS 


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

Re: [GitHub] incubator-metron pull request #166: METRON-247 Deployment fails on hosts wit...

[Nick Allen]

I often skip the wait also, but the mount checks are very time consuming
too.  This change helped me test the PR faster.  I'd prefer for it to just
go together.

On Wed, Jun 22, 2016 at 8:16 AM, dlyle65535  wrote:

> Github user dlyle65535 commented on a diff in the pull request:
>
>
> https://github.com/apache/incubator-metron/pull/166#discussion_r68042048
>
> --- Diff: metron-deployment/amazon-ec2/playbook.yml ---
> @@ -62,6 +62,7 @@
>  - include: tasks/check-volume.yml vol_name=xvda vol_src=/dev/xvda
> vol_size={{ xvda_vol_size }}
>tags:
>  - ec2
> +- ec2-mount
>
> --- End diff --
>
> I think the timely part is the wait, so --skip-tags="wait" usually
> works for me, but if you really want this, couldn't it be part of a JIRA
> that addresses performance rather than the snort deploy bug?
>
>
> ---
> If your project is set up for it, you can reply to this email and have your
> reply appear on GitHub as well. If your project does not have this feature
> enabled and wishes so, or if the feature is enabled but not working, please
> contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
> with INFRA.
> ---
>



-- 
Nick Allen 

[GitHub] incubator-metron pull request #166: METRON-247 Deployment fails on hosts wit...

[dlyle65535]

Github user dlyle65535 commented on a diff in the pull request:

https://github.com/apache/incubator-metron/pull/166#discussion_r68042048
  
--- Diff: metron-deployment/amazon-ec2/playbook.yml ---
@@ -62,6 +62,7 @@
 - include: tasks/check-volume.yml vol_name=xvda vol_src=/dev/xvda 
vol_size={{ xvda_vol_size }}
   tags:
 - ec2
+- ec2-mount
 
--- End diff --

I think the timely part is the wait, so --skip-tags="wait" usually works 
for me, but if you really want this, couldn't it be part of a JIRA that 
addresses performance rather than the snort deploy bug?


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #166: METRON-247 Deployment fails on hosts with no 'e...

[nickwallen]

Github user nickwallen commented on the issue:

https://github.com/apache/incubator-metron/pull/166
  
Tested on Vagrant and AWS


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron issue #153: Fixed error when start up the system.

[AdrianP-]

Github user AdrianP- commented on the issue:

https://github.com/apache/incubator-metron/pull/153
  
@nickwallen Sorry. Do it


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-metron pull request #153: Fixed error when start up the system.

[AdrianP-]

Github user AdrianP- closed the pull request at:

https://github.com/apache/incubator-metron/pull/153


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---