[jira] [Updated] (METRON-857) Metron should one unified docker build image

2017-04-21 Thread Otto Fowler (JIRA)

 [ 
https://issues.apache.org/jira/browse/METRON-857?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Otto Fowler updated METRON-857:
---
Description: 
Right now, we have a docker environment for building the code of the product, 
and a docker image for building rpms.

If you are in an environment that requires the first, you cannot use the second 
from there.

We should have a merged, unified metron build environment that builds the whole 
product.

This will enable workflows such as: 
https://cwiki.apache.org/confluence/display/METRON/Metron+Installation+on+an+Ambari-Managed+Cluster

That page can be updated once this is complete as well

The approach:

Using maven profiles and profile activation it is possible to have two versions 
of the exec call to build rpms, one that calls docker and one that just calls 
the script.


  was:
Right now, we have a docker environment for building the code of the product, 
and a docker image for building rpms.

If you are in an environment that requires the first, you cannot use the second 
from there.

We should have a merged, unified metron build environment that builds the whole 
product.

This will enable workflows such as: 
https://cwiki.apache.org/confluence/display/METRON/Metron+Installation+on+an+Ambari-Managed+Cluster

That page can be updated once this is complete as well


> Metron should one unified docker build image
> 
>
> Key: METRON-857
> URL: https://issues.apache.org/jira/browse/METRON-857
> Project: Metron
>  Issue Type: Improvement
>Reporter: Otto Fowler
>Assignee: Otto Fowler
>
> Right now, we have a docker environment for building the code of the product, 
> and a docker image for building rpms.
> If you are in an environment that requires the first, you cannot use the 
> second from there.
> We should have a merged, unified metron build environment that builds the 
> whole product.
> This will enable workflows such as: 
> https://cwiki.apache.org/confluence/display/METRON/Metron+Installation+on+an+Ambari-Managed+Cluster
> That page can be updated once this is complete as well
> The approach:
> Using maven profiles and profile activation it is possible to have two 
> versions of the exec call to build rpms, one that calls docker and one that 
> just calls the script.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-873) Stellar string literals do not support quote escaping

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15979218#comment-15979218
 ] 

ASF GitHub Bot commented on METRON-873:
---

Github user cestella commented on the issue:

https://github.com/apache/incubator-metron/pull/542
  
@ottobackwards you're totally right.  We desperately are in need of better 
stellar documentation:
* A language reference
* A set of introductory lessons in Stellar


> Stellar string literals do not support quote escaping
> -
>
> Key: METRON-873
> URL: https://issues.apache.org/jira/browse/METRON-873
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Right now, in stellar, we cannot represent a string literal that contains 
> 'foo' if the string is quoted with ' or "foo" if the string is quoted with ". 
>  This is unfortunate and should be corrected.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-873) Stellar string literals do not support quote escaping

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15979212#comment-15979212
 ] 

ASF GitHub Bot commented on METRON-873:
---

GitHub user cestella reopened a pull request:

https://github.com/apache/incubator-metron/pull/542

METRON-873: Stellar string literals do not support quote escaping

## Contributor Comments
Right now, in stellar, we cannot represent a string literal that contains 
`'foo'` if the string is quoted with `'` or `"foo"` if the string is quoted 
with `"`.  This is unfortunate and should be corrected.

To test this out, start up the stellar REPL in fulldev *or* run it locally 
by running `mvn exec:java 
-Dexec.mainClass="org.apache.metron.common.stellar.shell.StellarShell"` from 
`metron-platform/metron-common` and try the following strings:
* `'\'foo\''` should yield `'foo'`
* `"\"foo\""` should yield `"foo"`
* `TO_UPPER('\'foo\'')` should yield `'FOO'`
* `TO_UPPER("\"foo\"")` should yield `"FOO"`

## Pull Request Checklist

Thank you for submitting a contribution to Apache Metron (Incubating).  
Please refer to our [Development 
Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235)
 for the complete guide to follow for contributions.  
Please refer also to our [Build Verification 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview)
 for complete smoke testing guides.  


In order to streamline the review of the contribution we ask you follow 
these guidelines and ask you to double check the following:

### For all changes:
- [x] Is there a JIRA ticket associated with this PR? If not one needs to 
be created at [Metron 
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
 
- [x] Does your PR title start with METRON- where  is the JIRA 
number you are trying to resolve? Pay particular attention to the hyphen "-" 
character.
- [x] Has your PR been rebased against the latest commit within the target 
branch (typically master)?


### For code changes:
- [x] Have you included steps to reproduce the behavior or problem that is 
being changed or addressed?
- [x] Have you included steps or a guide to how the change may be verified 
and tested manually?
- [x] Have you ensured that the full suite of tests and checks have been 
executed in the root incubating-metron folder via:
  ```
  mvn -q clean integration-test install && build_utils/verify_licenses.sh 
  ```

- [x] Have you written or updated unit tests and or integration tests to 
verify your changes?
- [x] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)? 
- [x] Have you verified the basic functionality of the build by building 
and running locally with Vagrant full-dev environment or the equivalent?

### For documentation related changes:
- [x] Have you ensured that format looks appropriate for the output in 
which it is rendered by building and verifying the site-book? If not then run 
the following commands and the verify changes via 
`site-book/target/site/index.html`:

  ```
  cd site-book
  bin/generate-md.sh
  mvn site:site
  ```

 Note:
Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.
It is also recommended that [travis-ci](https://travis-ci.org) is set up 
for your personal repository such that your branches are built there before 
submitting a pull request.



You can merge this pull request into a Git repository by running:

$ git pull https://github.com/cestella/incubator-metron 
stellar_quoted_strings

Alternatively you can review and apply these changes as the patch at:

https://github.com/apache/incubator-metron/pull/542.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

This closes #542


commit cde9211b5bf7aa3ed4b91477605bbe6685540c71
Author: cstella 
Date:   2017-04-21T16:13:18Z

Add quote escaping to Stellar string literals.

commit 2920faaf24385330dab2a8490d7a599ab9aae822
Author: cstella 
Date:   2017-04-21T16:34:29Z

Documentationc hange.

commit 88338f110a5db945cb6ea1a99221cb2c6d49633c
Author: cstella 
Date:   2017-04-21T17:41:11Z

Cleaned up grammar a bit and added proper support for backslash.

commit f123ddf711e237f60a9bff140a6c47c4dc39fa53
Author: cstella 
Date:   2017-04-21T17:45:03Z

missed newlines

commit 

[jira] [Commented] (METRON-873) Stellar string literals do not support quote escaping

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15979148#comment-15979148
 ] 

ASF GitHub Bot commented on METRON-873:
---

Github user cestella commented on the issue:

https://github.com/apache/incubator-metron/pull/542
  
Yes, you're right.  Take a look now.  I also added support for \n, \t and 
\r while I was there.


> Stellar string literals do not support quote escaping
> -
>
> Key: METRON-873
> URL: https://issues.apache.org/jira/browse/METRON-873
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Right now, in stellar, we cannot represent a string literal that contains 
> 'foo' if the string is quoted with ' or "foo" if the string is quoted with ". 
>  This is unfortunate and should be corrected.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-873) Stellar string literals do not support quote escaping

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15979138#comment-15979138
 ] 

ASF GitHub Bot commented on METRON-873:
---

Github user justinleet commented on the issue:

https://github.com/apache/incubator-metron/pull/542
  
```
/code [Stellar]>>> " bar  foo "
 bar \\\ foo
```
Shouldn't that produce 'bar \\ foo' (One less backslash)?  It seems like 
it's not handling chained backslash escapes properly (or at least the way Java 
does, which I assume is the template).


> Stellar string literals do not support quote escaping
> -
>
> Key: METRON-873
> URL: https://issues.apache.org/jira/browse/METRON-873
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Right now, in stellar, we cannot represent a string literal that contains 
> 'foo' if the string is quoted with ' or "foo" if the string is quoted with ". 
>  This is unfortunate and should be corrected.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-861) Allow JVM args to be passed to CLI utilities

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-861?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15979071#comment-15979071
 ] 

ASF GitHub Bot commented on METRON-861:
---

Github user merrimanr commented on the issue:

https://github.com/apache/incubator-metron/pull/534
  
METRON_JVMFLAGS?


> Allow JVM args to be passed to CLI utilities
> 
>
> Key: METRON-861
> URL: https://issues.apache.org/jira/browse/METRON-861
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>Assignee: Casey Stella
>
> This is motivated by the fact that if one sets the acl's on the znodes that 
> metron creates (e.g. /metron/topology/global) to read/write by metron (from 
> the zkcli `setAcl /metron/topology/global sasl:metron:crwda`), then 
> permissions prohibit the CLI tools from functioning because the JAAS config 
> is not loaded.
> This JIRA allows users to pass java properties to the CLI tools.  While 
> important for Kerberos, it's useful in general if one needs to adjust the 
> heap required, etc.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-861) Allow JVM args to be passed to CLI utilities

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-861?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15979069#comment-15979069
 ] 

ASF GitHub Bot commented on METRON-861:
---

Github user cestella commented on the issue:

https://github.com/apache/incubator-metron/pull/534
  
You know, we definitely could.  I chose JVMFLAGS because it's what 
zookeeper calls them, but I'm open to other options.  Any suggestions?


> Allow JVM args to be passed to CLI utilities
> 
>
> Key: METRON-861
> URL: https://issues.apache.org/jira/browse/METRON-861
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>Assignee: Casey Stella
>
> This is motivated by the fact that if one sets the acl's on the znodes that 
> metron creates (e.g. /metron/topology/global) to read/write by metron (from 
> the zkcli `setAcl /metron/topology/global sasl:metron:crwda`), then 
> permissions prohibit the CLI tools from functioning because the JAAS config 
> is not loaded.
> This JIRA allows users to pass java properties to the CLI tools.  While 
> important for Kerberos, it's useful in general if one needs to adjust the 
> heap required, etc.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-873) Stellar string literals do not support quote escaping

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15979020#comment-15979020
 ] 

ASF GitHub Bot commented on METRON-873:
---

GitHub user cestella opened a pull request:

https://github.com/apache/incubator-metron/pull/542

METRON-873: Stellar string literals do not support quote escaping

## Contributor Comments
Right now, in stellar, we cannot represent a string literal that contains 
`'foo'` if the string is quoted with `'` or `"foo"` if the string is quoted 
with `"`.  This is unfortunate and should be corrected.

To test this out, start up the stellar REPL in fulldev *or* run it locally 
by running `mvn exec:java 
-Dexec.mainClass="org.apache.metron.common.stellar.shell.StellarShell"` from 
`metron-platform/metron-common` and try the following strings:
* `'\'foo\''` should yield `'foo'`
* `"\"foo\""` should yield `"foo"`
* `TO_UPPER('\'foo\'')` should yield `'FOO'`
* `TO_UPPER("\"foo\"")` should yield `"FOO"`

## Pull Request Checklist

Thank you for submitting a contribution to Apache Metron (Incubating).  
Please refer to our [Development 
Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235)
 for the complete guide to follow for contributions.  
Please refer also to our [Build Verification 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview)
 for complete smoke testing guides.  


In order to streamline the review of the contribution we ask you follow 
these guidelines and ask you to double check the following:

### For all changes:
- [x] Is there a JIRA ticket associated with this PR? If not one needs to 
be created at [Metron 
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
 
- [x] Does your PR title start with METRON- where  is the JIRA 
number you are trying to resolve? Pay particular attention to the hyphen "-" 
character.
- [x] Has your PR been rebased against the latest commit within the target 
branch (typically master)?


### For code changes:
- [x] Have you included steps to reproduce the behavior or problem that is 
being changed or addressed?
- [x] Have you included steps or a guide to how the change may be verified 
and tested manually?
- [x] Have you ensured that the full suite of tests and checks have been 
executed in the root incubating-metron folder via:
  ```
  mvn -q clean integration-test install && build_utils/verify_licenses.sh 
  ```

- [x] Have you written or updated unit tests and or integration tests to 
verify your changes?
- [x] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)? 
- [x] Have you verified the basic functionality of the build by building 
and running locally with Vagrant full-dev environment or the equivalent?

### For documentation related changes:
- [x] Have you ensured that format looks appropriate for the output in 
which it is rendered by building and verifying the site-book? If not then run 
the following commands and the verify changes via 
`site-book/target/site/index.html`:

  ```
  cd site-book
  bin/generate-md.sh
  mvn site:site
  ```

 Note:
Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.
It is also recommended that [travis-ci](https://travis-ci.org) is set up 
for your personal repository such that your branches are built there before 
submitting a pull request.



You can merge this pull request into a Git repository by running:

$ git pull https://github.com/cestella/incubator-metron 
stellar_quoted_strings

Alternatively you can review and apply these changes as the patch at:

https://github.com/apache/incubator-metron/pull/542.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

This closes #542


commit cde9211b5bf7aa3ed4b91477605bbe6685540c71
Author: cstella 
Date:   2017-04-21T16:13:18Z

Add quote escaping to Stellar string literals.




> Stellar string literals do not support quote escaping
> -
>
> Key: METRON-873
> URL: https://issues.apache.org/jira/browse/METRON-873
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Right now, in stellar, we cannot represent a string literal that contains 
> 'foo' if the string is quoted with ' or "foo" if the string is quoted with ". 
>  This is 

[jira] [Commented] (METRON-870) Add filtering by packet payload to the pcap query

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978868#comment-15978868
 ] 

ASF GitHub Bot commented on METRON-870:
---

Github user nishihatapalmer commented on the issue:

https://github.com/apache/incubator-metron/pull/541
  
Correct, there's no NFA or DFA under the hood of the SequenceMatcher.  

You can create sequences using the regex syntax using the 
SequenceMatcherCompiler, as long as only syntax which creates fixed length 
sequences is used.  So you can match bytes (hex values), sets of bytes [01 02 
03], any bytes ., bitmasks, strings and case insensitive strings, but not 
wildcards or optional bytes.  For example:

01 ^02 'a string' [f0-ff] 'another string' [0a 0d]

The RegexCompiler can accept the full regex syntax including *, +, ?, and 
it does create NFAs - but this isn't tested.




> Add filtering by packet payload to the pcap query
> -
>
> Key: METRON-870
> URL: https://issues.apache.org/jira/browse/METRON-870
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Currently we have the ability to filter packets in the pcap query tool by 
> header information (src/dest ip/port).  We should be able to filter by binary 
> regex on the packets themselves. 



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-867) In the event that we graduate, remove incubating from the website and documentation

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978845#comment-15978845
 ] 

ASF GitHub Bot commented on METRON-867:
---

Github user justinleet commented on the issue:

https://github.com/apache/incubator-metron/pull/539
  
I'm fine with looking at it Monday.  I may take a quick look if there's any 
JIRAs from other projects we can steal as a starting template, but if not we 
can start running through the graduation guides and creating tickets as needed.


> In the event that we graduate, remove incubating from the website and 
> documentation
> ---
>
> Key: METRON-867
> URL: https://issues.apache.org/jira/browse/METRON-867
> Project: Metron
>  Issue Type: Task
>Reporter: Casey Stella
>Assignee: Casey Stella
>
> The title says it all.  Note: This JIRA is not an indication of graduation, 
> just preparing for the possibility.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-872) "Metron Enrichment Start" Fails in Quick Dev

2017-04-21 Thread Nick Allen (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-872?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978853#comment-15978853
 ] 

Nick Allen commented on METRON-872:
---

Full listing of what's under `/usr/metron` on the VM.

{code}
[root@node1 metron]# find ./
./
./0.3.1
./0.3.1/lib
./0.3.1/lib/metron-pcap-backend-0.3.1.jar
./0.3.1/lib/metron-api-0.3.1.jar
./0.3.1/config
./0.3.1/config/metron_indexing_configured
./0.3.1/config/elasticsearch.properties
./0.3.1/config/zookeeper
./0.3.1/config/zookeeper/global.json
./0.3.1/config/zookeeper/indexing
./0.3.1/config/metron_enrichment_geo_configured
./0.3.1/config/metron_enrichment_hbase_configured
./0.3.1/config/metron_enrichment_kafka_configured
./0.3.1/config/pcap.properties
./0.3.1/config/zeppelin
./0.3.1/config/zeppelin/metron
./0.3.1/config/metron_parsers_configured
./0.3.1/config/enrichment.properties
./0.3.1/flux
./0.3.1/flux/pcap
./0.3.1/flux/pcap/remote.yaml
./0.3.1/bin
./0.3.1/bin/start_pcap_topology.sh
./0.3.1/bin/pcap_query.sh
./0.3.1/bin/pcap_inspector.sh
./0.4.0
./0.4.0/lib
./0.4.0/lib/metron-elasticsearch-0.4.0-uber.jar
./0.4.0/lib/metron-parsers-0.4.0-uber.jar
./0.4.0/lib/metron-enrichment-0.4.0-uber.jar
./0.4.0/lib/metron-common-0.4.0.jar
./0.4.0/lib/metron-data-management-0.4.0.jar
./0.4.0/config
./0.4.0/config/elasticsearch.properties
./0.4.0/config/zookeeper
./0.4.0/config/zookeeper/enrichments
./0.4.0/config/zookeeper/enrichments/snort.json
./0.4.0/config/zookeeper/enrichments/websphere.json
./0.4.0/config/zookeeper/enrichments/yaf.json
./0.4.0/config/zookeeper/enrichments/bro.json
./0.4.0/config/zookeeper/enrichments/asa.json
./0.4.0/config/zookeeper/parsers
./0.4.0/config/zookeeper/parsers/snort.json
./0.4.0/config/zookeeper/parsers/jsonMap.json
./0.4.0/config/zookeeper/parsers/websphere.json
./0.4.0/config/zookeeper/parsers/yaf.json
./0.4.0/config/zookeeper/parsers/bro.json
./0.4.0/config/zookeeper/parsers/squid.json
./0.4.0/config/zookeeper/parsers/asa.json
./0.4.0/config/zookeeper/indexing
./0.4.0/config/zookeeper/indexing/snort.json
./0.4.0/config/zookeeper/indexing/websphere.json
./0.4.0/config/zookeeper/indexing/error.json
./0.4.0/config/zookeeper/indexing/yaf.json
./0.4.0/config/zookeeper/indexing/bro.json
./0.4.0/config/zookeeper/indexing/asa.json
./0.4.0/config/zeppelin
./0.4.0/config/zeppelin/metron
./0.4.0/config/zeppelin/metron/metron-yaf-telemetry.json
./0.4.0/config/enrichment.properties
./0.4.0/patterns
./0.4.0/patterns/squid
./0.4.0/patterns/yaf
./0.4.0/patterns/common
./0.4.0/patterns/sourcefire
./0.4.0/patterns/fireeye
./0.4.0/patterns/asa
./0.4.0/patterns/websphere
./0.4.0/flux
./0.4.0/flux/enrichment
./0.4.0/flux/enrichment/remote.yaml
./0.4.0/flux/indexing
./0.4.0/flux/indexing/remote.yaml
./0.4.0/bin
./0.4.0/bin/geo_enrichment_load.sh
./0.4.0/bin/prune_hdfs_files.sh
./0.4.0/bin/latency_summarizer.sh
./0.4.0/bin/flatfile_loader.sh
./0.4.0/bin/start_elasticsearch_topology.sh
./0.4.0/bin/start_enrichment_topology.sh
./0.4.0/bin/start_parser_topology.sh
./0.4.0/bin/prune_elasticsearch_indices.sh
./0.4.0/bin/zk_load_configs.sh
./0.4.0/bin/threatintel_bulk_prune.sh
./0.4.0/bin/threatintel_taxii_load.sh
./0.4.0/bin/Whois_CSV_to_JSON.py
./0.4.0/bin/stellar
{code}

> "Metron Enrichment Start" Fails in Quick Dev
> 
>
> Key: METRON-872
> URL: https://issues.apache.org/jira/browse/METRON-872
> Project: Metron
>  Issue Type: Bug
>Reporter: Nick Allen
>
> h3. Problem
> The "Quick Dev" deployment fails to complete deployment successfully for me.  
> Ambari fails to launch the Enrichment topology with this error.
> {code}
> resource_management.core.exceptions.ExecutionFailed: Execution of 
> '/usr/metron/0.3.1/bin/zk_load_configs.sh --mode PUSH -i 
> /usr/metron/0.3.1/config/zookeeper -z node1:2181' returned 127. /bin/bash: 
> /usr/metron/0.3.1/bin/zk_load_configs.sh: No such file or directory
> {code}
> This is confusing to me because we should be on 0.4.0, so why is it 
> referencing 0.3.1?
> h3. Steps to Reproduce
> First, I had to `install` the Metron libs (which I don't remember being a 
> requirement before.)  Then I was able to `vagrant up`.
> {code}
> cd incubator-metron
> mvn clean install -DskipTests -T 1C
> cd metron-deployment/vagrant/quick-dev-platform
> vagrant up
> {code}
> h3. Additional Clues
> When I login to the "Quick Dev" VM, I see that there are some 0.4.0 libs and 
> some 0.3.1 libs. 
> {code}
> [root@node1 metron]# ls -l /usr/metron/0.3.1/lib/
> total 167800
> -rw-r--r--. 1 root root 85332259 Apr  3 21:05 metron-api-0.3.1.jar
> -rw-r--r--. 1 root root 86490682 Mar 30 13:09 metron-pcap-backend-0.3.1.jar
> [root@node1 metron]# ls -l /usr/metron/0.4.0/lib/
> total 463428
> -rw-r--r--. 1 root root  48425098 Apr 21 13:45 metron-common-0.4.0.jar
> -rw-r--r--. 1 root root 124020704 Apr 21 13:50 
> metron-data-management-0.4.0.jar
> -rw-r--r--. 1 root 

[jira] [Commented] (METRON-872) "Metron Enrichment Start" Fails in Quick Dev

2017-04-21 Thread Otto Fowler (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-872?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978844#comment-15978844
 ] 

Otto Fowler commented on METRON-872:


I 'think' that quickdev is actually build from full_dev, with metron installed 
already.  So it may be that we need a new image built to make this not an 
upgrade situation?



> "Metron Enrichment Start" Fails in Quick Dev
> 
>
> Key: METRON-872
> URL: https://issues.apache.org/jira/browse/METRON-872
> Project: Metron
>  Issue Type: Bug
>Reporter: Nick Allen
>
> h3. Problem
> The "Quick Dev" deployment fails to complete deployment successfully for me.  
> Ambari fails to launch the Enrichment topology with this error.
> {code}
> resource_management.core.exceptions.ExecutionFailed: Execution of 
> '/usr/metron/0.3.1/bin/zk_load_configs.sh --mode PUSH -i 
> /usr/metron/0.3.1/config/zookeeper -z node1:2181' returned 127. /bin/bash: 
> /usr/metron/0.3.1/bin/zk_load_configs.sh: No such file or directory
> {code}
> This is confusing to me because we should be on 0.4.0, so why is it 
> referencing 0.3.1?
> h3. Steps to Reproduce
> First, I had to `install` the Metron libs (which I don't remember being a 
> requirement before.)  Then I was able to `vagrant up`.
> {code}
> cd incubator-metron
> mvn clean install -DskipTests -T 1C
> cd metron-deployment/vagrant/quick-dev-platform
> vagrant up
> {code}
> h3. Additional Clues
> When I login to the "Quick Dev" VM, I see that there are some 0.4.0 libs and 
> some 0.3.1 libs. 
> {code}
> [root@node1 metron]# ls -l /usr/metron/0.3.1/lib/
> total 167800
> -rw-r--r--. 1 root root 85332259 Apr  3 21:05 metron-api-0.3.1.jar
> -rw-r--r--. 1 root root 86490682 Mar 30 13:09 metron-pcap-backend-0.3.1.jar
> [root@node1 metron]# ls -l /usr/metron/0.4.0/lib/
> total 463428
> -rw-r--r--. 1 root root  48425098 Apr 21 13:45 metron-common-0.4.0.jar
> -rw-r--r--. 1 root root 124020704 Apr 21 13:50 
> metron-data-management-0.4.0.jar
> -rw-r--r--. 1 root root 114754821 Apr 21 13:50 
> metron-elasticsearch-0.4.0-uber.jar
> -rw-r--r--. 1 root root  93280994 Apr 21 13:48 
> metron-enrichment-0.4.0-uber.jar
> -rw-r--r--. 1 root root  94059479 Apr 21 13:50 metron-parsers-0.4.0-uber.jar
> {code}
> Where did those 0.3.1 libs come from?  When I look in my local Maven 
> repository on my build machine, I don't see any 0.3.1 libs at all, only 0.4.0
> {code}
> $ find ~/.m2/repository/org/apache/metron/ -name "0.3.1"
> $ find ~/.m2/repository/org/apache/metron/ -name "0.4.0"
> /Users/nallen/.m2/repository/org/apache/metron//elasticsearch-shaded/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//Metron/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-analytics/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-api/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-common/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-config/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-data-management/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-deployment/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-docker/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-elasticsearch/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-enrichment/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-hbase/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-indexing/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-integration-test/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-interface/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-maas-common/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-maas-service/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-management/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-parsers/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-pcap/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-pcap-backend/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-platform/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-profiler/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-profiler-client/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-profiler-common/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-rest/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-rest-client/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-solr/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-statistics/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-storm-kafka/0.4.0
> /Users/nallen/.m2/repository/org/apache/metron//metron-test-utilities/0.4.0
> 

[jira] [Commented] (METRON-870) Add filtering by packet payload to the pcap query

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978831#comment-15978831
 ] 

ASF GitHub Bot commented on METRON-870:
---

Github user cestella commented on the issue:

https://github.com/apache/incubator-metron/pull/541
  
Currently, I'm using the SequenceMatcher to compile a matching expression 
and then using a searcher to search in the byte array for that expression (code 
is 
[here](https://github.com/cestella/incubator-metron/blob/c50a50d230ae1d71a7a512fc199e26264b17ca60/metron-platform/metron-pcap/src/main/java/org/apache/metron/pcap/pattern/ByteArrayMatchingUtil.java)
 ).  From what I can tell, this isn't using the NFA or DFA under the hood, is 
that wrong?


> Add filtering by packet payload to the pcap query
> -
>
> Key: METRON-870
> URL: https://issues.apache.org/jira/browse/METRON-870
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Currently we have the ability to filter packets in the pcap query tool by 
> header information (src/dest ip/port).  We should be able to filter by binary 
> regex on the packets themselves. 



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Created] (METRON-872) "Metron Enrichment Start" Fails in Quick Dev

2017-04-21 Thread Nick Allen (JIRA)
Nick Allen created METRON-872:
-

 Summary: "Metron Enrichment Start" Fails in Quick Dev
 Key: METRON-872
 URL: https://issues.apache.org/jira/browse/METRON-872
 Project: Metron
  Issue Type: Bug
Reporter: Nick Allen


h3. Problem

The "Quick Dev" deployment fails to complete deployment successfully for me.  
Ambari fails to launch the Enrichment topology with this error.

{code}
resource_management.core.exceptions.ExecutionFailed: Execution of 
'/usr/metron/0.3.1/bin/zk_load_configs.sh --mode PUSH -i 
/usr/metron/0.3.1/config/zookeeper -z node1:2181' returned 127. /bin/bash: 
/usr/metron/0.3.1/bin/zk_load_configs.sh: No such file or directory
{code}

This is confusing to me because we should be on 0.4.0, so why is it referencing 
0.3.1?

h3. Steps to Reproduce

First, I had to `install` the Metron libs (which I don't remember being a 
requirement before.)  Then I was able to `vagrant up`.

{code}
cd incubator-metron
mvn clean install -DskipTests -T 1C

cd metron-deployment/vagrant/quick-dev-platform
vagrant up
{code}

h3. Additional Clues

When I login to the "Quick Dev" VM, I see that there are some 0.4.0 libs and 
some 0.3.1 libs. 

{code}
[root@node1 metron]# ls -l /usr/metron/0.3.1/lib/
total 167800
-rw-r--r--. 1 root root 85332259 Apr  3 21:05 metron-api-0.3.1.jar
-rw-r--r--. 1 root root 86490682 Mar 30 13:09 metron-pcap-backend-0.3.1.jar

[root@node1 metron]# ls -l /usr/metron/0.4.0/lib/
total 463428
-rw-r--r--. 1 root root  48425098 Apr 21 13:45 metron-common-0.4.0.jar
-rw-r--r--. 1 root root 124020704 Apr 21 13:50 metron-data-management-0.4.0.jar
-rw-r--r--. 1 root root 114754821 Apr 21 13:50 
metron-elasticsearch-0.4.0-uber.jar
-rw-r--r--. 1 root root  93280994 Apr 21 13:48 metron-enrichment-0.4.0-uber.jar
-rw-r--r--. 1 root root  94059479 Apr 21 13:50 metron-parsers-0.4.0-uber.jar
{code}

Where did those 0.3.1 libs come from?  When I look in my local Maven repository 
on my build machine, I don't see any 0.3.1 libs at all, only 0.4.0

{code}
$ find ~/.m2/repository/org/apache/metron/ -name "0.3.1"

$ find ~/.m2/repository/org/apache/metron/ -name "0.4.0"
/Users/nallen/.m2/repository/org/apache/metron//elasticsearch-shaded/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//Metron/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-analytics/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-api/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-common/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-config/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-data-management/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-deployment/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-docker/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-elasticsearch/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-enrichment/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-hbase/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-indexing/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-integration-test/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-interface/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-maas-common/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-maas-service/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-management/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-parsers/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-pcap/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-pcap-backend/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-platform/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-profiler/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-profiler-client/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-profiler-common/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-rest/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-rest-client/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-solr/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-statistics/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-storm-kafka/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-test-utilities/0.4.0
/Users/nallen/.m2/repository/org/apache/metron//metron-writer/0.4.0

{code}

I seem to have the latest "Quick Dev" box image.

{code}
$ vagrant box update
 Running with ansible-tags: ["quick_dev", "report"]
==> node1: Checking for updates to 'metron/quick_dev'
node1: Latest installed version: 0.2.0
node1: Version constraints:
node1: Provider: virtualbox
==> node1: Box 'metron/quick_dev' (v0.2.0) is running the latest version.
{code}

And for good measure, here is what my environment looks-like.

{code}
$ ./metron-deployment/scripts/platform-info.sh
Metron 0.4.0
--

[jira] [Commented] (METRON-867) In the event that we graduate, remove incubating from the website and documentation

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978827#comment-15978827
 ] 

ASF GitHub Bot commented on METRON-867:
---

Github user cestella commented on the issue:

https://github.com/apache/incubator-metron/pull/539
  
No, no follow-on tickets as of yet.  I was planning on looking at it Monday 
after the press release and formulating a plan and discussing with the 
community any impact that might have.

If anyone wants to take a gander earlier than that and create some JIRAs, 
I'd not be opposed to that.  It doesn't take the VP, just a PMC member to push 
the buttons, but pretty much anyone in the community can formulate a plan.


> In the event that we graduate, remove incubating from the website and 
> documentation
> ---
>
> Key: METRON-867
> URL: https://issues.apache.org/jira/browse/METRON-867
> Project: Metron
>  Issue Type: Task
>Reporter: Casey Stella
>Assignee: Casey Stella
>
> The title says it all.  Note: This JIRA is not an indication of graduation, 
> just preparing for the possibility.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-870) Add filtering by packet payload to the pcap query

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978744#comment-15978744
 ] 

ASF GitHub Bot commented on METRON-870:
---

Github user nishihatapalmer commented on the issue:

https://github.com/apache/incubator-metron/pull/541
  
When you say use regexes, do you mean use the regex syntax to create fixed 
length sequences, or do you mean use full regex functionality?  Full regex 
exists using NFAs and DFAs, but needs testing, as I haven't looked at that part 
of byteseek for quite some time.


> Add filtering by packet payload to the pcap query
> -
>
> Key: METRON-870
> URL: https://issues.apache.org/jira/browse/METRON-870
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Currently we have the ability to filter packets in the pcap query tool by 
> header information (src/dest ip/port).  We should be able to filter by binary 
> regex on the packets themselves. 



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-870) Add filtering by packet payload to the pcap query

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978731#comment-15978731
 ] 

ASF GitHub Bot commented on METRON-870:
---

Github user nishihatapalmer commented on the issue:

https://github.com/apache/incubator-metron/pull/541
  
There is a slightly out of date (note to self: update this!) syntax 
document at:

https://github.com/nishihatapalmer/byteseek/blob/master/src/main/java/net/byteseek/parser/regex/Regular%20Expression%20syntax.txt

It gives an overview of most of the syntax, but some of it is only usable 
by full regexes, not sequence matchers.  In particular it can only accept 
syntax which leads to a fixed length expression, so these are **excluded**:

```
*  zero to many
+ one to many
() groups
{n,n} n to m copies.
 X | Y alternatives.
```

Shorthands defined in this document also do not currently function properly 
(e.g. [ascii].

Finally note that inversion  ^ functions differently to most regular 
expression syntaxes.  The token being inverted is the following token, not the 
entire set.  So most regex would say something like [^ 01 02 03] meaning every 
byte except 01, 02 and 03.  In byteseek this would be ^[ 01 02 03], as you are 
inverting the set.  [ ^01 02 03] is also valid - except you are now specifying 
a set containing everything but 01 (which already covers 02 and 03).

 It's fairly easy to create a different parser if necessary, but most of 
byteseek regex syntax is fairly standard - but oriented towards bytes rather 
than strings as the default atomic unit.

Any questions please feel free to ask (and I really must update the syntax 
document!).

Regards,

Matt.


> Add filtering by packet payload to the pcap query
> -
>
> Key: METRON-870
> URL: https://issues.apache.org/jira/browse/METRON-870
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Currently we have the ability to filter packets in the pcap query tool by 
> header information (src/dest ip/port).  We should be able to filter by binary 
> regex on the packets themselves. 



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-870) Add filtering by packet payload to the pcap query

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978720#comment-15978720
 ] 

ASF GitHub Bot commented on METRON-870:
---

GitHub user cestella reopened a pull request:

https://github.com/apache/incubator-metron/pull/541

METRON-870: Add filtering by packet payload to the pcap query

## Contributor Comments
Currently we have the ability to filter packets in the pcap query tool by 
header information (src/dest ip/port). We should be able to filter by binary 
regex on the packets themselves.

Probably the state of the art and the goal to get to here is integration 
with [Yara](https://virustotal.github.io/yara/), but I'd like to iterate toward 
that solution for a couple of reasons:
* Yara is hard to integrate with in our stack.
  * It's C and, while the [yara-java](https://github.com/p8a/yara-java) 
project does exist, it would make the build a bit of a pain and no longer 
platform agnostic (i.e. you'd have to build certain modules against the 
machines that you're running in the cluster).  There are paths through that for 
sure, but it's more than I wanted to tackle just now.
* The core abstraction for the obvious integration yara-java is running 
yara over a file, not a byte array.  This would necessitate taking the 
performance penalty with JNI AND writing out every packet to a temporary file, 
then deleting it, in the MR job.  I did not deem that a sensible approach.
* Yara is a whole language, similar to stellar.  The point of integration 
would be as a proper `org.apache.metron.pcap.filter.PcapFilter`, not as a 
portion of an existing one.

That lead me to look for a stop-gap that was simpler and had the following 
characteristics:
* Worked within Java easily
* Was permissively licensed
* Functioned on byte arrays
* Could do both hex regex as well as interpreting the byte array as a 
string (similar to Yara)

[bytestream](https://github.com/nishihatapalmer/byteseek) ( an all java 
regex library that functions on byte arrays, not files) fit the bill without 
eating all of a full-on Yara integration and fit within our core abstractions 
better.  

As such, the approach that I took is to provide the capability both of the 
packet filters that we currently have in place:
* Fixed via a new command line option `--packet_filter` or `-pf` wherein 
you pass the binary regex.
  * This would restrict to a single pattern
* Query via a new Stellar function `BYTEARRAY_MATCHER(pattern, packet)`
  * This allows you to compose multiple filters with logic operations to 
get a closer to Yara-esque feel via Stellar

I have made a follow-on task to integrate with Yara at 
[METRON-871](https://issues.apache.org/jira/browse/METRON-871).

Testing plan will be in the comments.

## Pull Request Checklist

Thank you for submitting a contribution to Apache Metron (Incubating).  
Please refer to our [Development 
Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235)
 for the complete guide to follow for contributions.  
Please refer also to our [Build Verification 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview)
 for complete smoke testing guides.  


In order to streamline the review of the contribution we ask you follow 
these guidelines and ask you to double check the following:

### For all changes:
- [x] Is there a JIRA ticket associated with this PR? If not one needs to 
be created at [Metron 
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
 
- [x] Does your PR title start with METRON- where  is the JIRA 
number you are trying to resolve? Pay particular attention to the hyphen "-" 
character.
- [x] Has your PR been rebased against the latest commit within the target 
branch (typically master)?


### For code changes:
- [ ] Have you included steps to reproduce the behavior or problem that is 
being changed or addressed?
- [ ] Have you included steps or a guide to how the change may be verified 
and tested manually?
- [x] Have you ensured that the full suite of tests and checks have been 
executed in the root incubating-metron folder via:
  ```
  mvn -q clean integration-test install && build_utils/verify_licenses.sh 
  ```

- [ ] Have you written or updated unit tests and or integration tests to 
verify your changes?
- [x] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)? 
- [ ] Have you verified the basic functionality of the build by building 
and running locally with Vagrant full-dev environment or 

[jira] [Commented] (METRON-870) Add filtering by packet payload to the pcap query

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978719#comment-15978719
 ] 

ASF GitHub Bot commented on METRON-870:
---

Github user cestella closed the pull request at:

https://github.com/apache/incubator-metron/pull/541


> Add filtering by packet payload to the pcap query
> -
>
> Key: METRON-870
> URL: https://issues.apache.org/jira/browse/METRON-870
> Project: Metron
>  Issue Type: Improvement
>Reporter: Casey Stella
>
> Currently we have the ability to filter packets in the pcap query tool by 
> header information (src/dest ip/port).  We should be able to filter by binary 
> regex on the packets themselves. 



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-867) In the event that we graduate, remove incubating from the website and documentation

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978713#comment-15978713
 ] 

ASF GitHub Bot commented on METRON-867:
---

Github user justinleet commented on the issue:

https://github.com/apache/incubator-metron/pull/539
  
+1, I took a look through the site and didn't see anything wrong and also 
searched the code a bit for signs of incubation.

Do we have tickets for any of the follow-on work mentioned, e.g. the 
changing the repo references?


> In the event that we graduate, remove incubating from the website and 
> documentation
> ---
>
> Key: METRON-867
> URL: https://issues.apache.org/jira/browse/METRON-867
> Project: Metron
>  Issue Type: Task
>Reporter: Casey Stella
>Assignee: Casey Stella
>
> The title says it all.  Note: This JIRA is not an indication of graduation, 
> just preparing for the possibility.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-869) Include build instructions for full-dev platform

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-869?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978128#comment-15978128
 ] 

ASF GitHub Bot commented on METRON-869:
---

Github user anandsubbu closed the pull request at:

https://github.com/apache/incubator-metron/pull/540


> Include build instructions for full-dev platform
> 
>
> Key: METRON-869
> URL: https://issues.apache.org/jira/browse/METRON-869
> Project: Metron
>  Issue Type: Bug
>Affects Versions: 0.3.1
>Reporter: Anand Subramanian
>Assignee: Anand Subramanian
>
> Include the below steps in the instructions to build full-dev platform at 
> https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/full-dev-platform#deploy-metron
> {code}
> cd incubator-metron
> mvn clean install -DskipTests
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)


[jira] [Commented] (METRON-869) Include build instructions for full-dev platform

2017-04-21 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-869?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15978127#comment-15978127
 ] 

ASF GitHub Bot commented on METRON-869:
---

Github user anandsubbu commented on the issue:

https://github.com/apache/incubator-metron/pull/540
  
Got it, thanks @dlyle65535 . Closing this pull request.


> Include build instructions for full-dev platform
> 
>
> Key: METRON-869
> URL: https://issues.apache.org/jira/browse/METRON-869
> Project: Metron
>  Issue Type: Bug
>Affects Versions: 0.3.1
>Reporter: Anand Subramanian
>Assignee: Anand Subramanian
>
> Include the below steps in the instructions to build full-dev platform at 
> https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/full-dev-platform#deploy-metron
> {code}
> cd incubator-metron
> mvn clean install -DskipTests
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)