Re: [ANOUNUCE] Metron IRC Channel

2016-04-13 Thread David Lyle
Good deal- is there any interest in setting up the asf ircbot? http://www.apache.org/dev/asfbot.html. Happy to file the infra ticket. -D... On Tue, Apr 12, 2016 at 10:18 AM, James Sirota wrote: > Thanks to Debo we now have IRC chat for Metron so we can all talk in real > time. > > /join #apach

[GitHub] incubator-metron pull request: Unit tests for enrichment adapters

2016-04-13 Thread franklu1
GitHub user franklu1 opened a pull request: https://github.com/apache/incubator-metron/pull/75 Unit tests for enrichment adapters Unit tests for enrichment adapters. You can merge this pull request into a Git repository by running: $ git pull https://github.com/franklu1/incuba

Re: [ANOUNUCE] Metron IRC Channel

2016-04-13 Thread James Sirota
I like the secretary and record keeping features. But the rest of it I think will spam the IRC channel. Do you know if there is a way to enable just some of the bot’s features? Thanks, James On 4/13/16, 3:30 AM, "David Lyle" wrote: >Good deal- is there any interest in setting up the asf

Re: [DISCUSS] Project reorganization

2016-04-13 Thread Ryan Merriman
Thank you for all the feedback everyone. I will attempt to summarize all the input we¹ve received and update my initial proposal. We can discuss further if anyone is still unclear and I will volunteer to capture all the details in a document of some kind once we all come to a consensus. Looks li

Re: [DISCUSS] Project reorganization

2016-04-13 Thread James Sirota
+1 from me. I would also like to address the configs and make sure the configs are in the same place. Do you have ideas on where we would put those? Thanks, James On 4/13/16, 6:50 AM, "Ryan Merriman" wrote: >Thank you for all the feedback everyone. I will attempt to summarize all >the in

Re: [DISCUSS] Project reorganization

2016-04-13 Thread Ryan Merriman
To answer a couple of other questions people asked: Debo, agreed having clear extension points is going to be extremely important for us. Currently we have well defined interfaces for parsers and enrichment adapters as well as the ability to load data into and drive enrichments (threat intels) fr

Re: [DISCUSS] Project reorganization

2016-04-13 Thread Nick Allen
+1 I like it. On Wed, Apr 13, 2016 at 9:59 AM, Ryan Merriman wrote: > To answer a couple of other questions people asked: > > Debo, agreed having clear extension points is going to be extremely > important for us. Currently we have well defined interfaces for parsers > and enrichment adapters a

[GitHub] incubator-metron pull request: METRON-108 Created fast packet capt...

2016-04-13 Thread merrimanr
Github user merrimanr commented on the pull request: https://github.com/apache/incubator-metron/pull/73#issuecomment-209475361 +1 from me --- If your project is set up for it, you can reply to this email and have your reply appear on GitHub as well. If your project does not have this

Re: [DISCUSS] Project reorganization

2016-04-13 Thread Ryan Merriman
James brings up a good point. I propose adding another project under metron-platform called metron-configuration. This would be a fairly lightweight project that would contain anything related to configuration (property files, json files, flux files, etc). On 4/13/16, 8:56 AM, "James Sirota" wr

Re: [DISCUSS] Project reorganization

2016-04-13 Thread James Sirota
I would have configs as a project but rather as a folder structure that other modules can point to Thanks, James On 4/13/16, 7:32 AM, "Ryan Merriman" wrote: >James brings up a good point. I propose adding another project under >metron-platform called metron-configuration. This would be

[GitHub] incubator-metron pull request: METRON-108 Created fast packet capt...

2016-04-13 Thread asfgit
Github user asfgit closed the pull request at: https://github.com/apache/incubator-metron/pull/73 --- If your project is set up for it, you can reply to this email and have your reply appear on GitHub as well. If your project does not have this feature enabled and wishes so, or if the featur

[GitHub] incubator-metron pull request: Unit tests for enrichment adapters

2016-04-13 Thread franklu1
Github user franklu1 closed the pull request at: https://github.com/apache/incubator-metron/pull/75 --- If your project is set up for it, you can reply to this email and have your reply appear on GitHub as well. If your project does not have this feature enabled and wishes so, or if the feat

Re: [ANOUNUCE] Metron IRC Channel

2016-04-13 Thread Elana Hashman
+1 to the IRC bot! From: David Lyle Sent: Wednesday, April 13, 2016 6:30 AM To: dev@metron.incubator.apache.org Subject: Re: [ANOUNUCE] Metron IRC Channel Good deal- is there any interest in setting up the asf ircbot? http://www.apache.org/dev/asfbot.html.

Re: [ANOUNUCE] Metron IRC Channel

2016-04-13 Thread Debojyoti Dutta
Will do Sent from my iPhone > On Apr 13, 2016, at 9:06 AM, Elana Hashman > wrote: > > +1 to the IRC bot! > > From: David Lyle > Sent: Wednesday, April 13, 2016 6:30 AM > To: dev@metron.incubator.apache.org > Subject: Re: [ANOUNUCE] Metron IRC Channel

Re: [ANOUNUCE] Metron IRC Channel

2016-04-13 Thread Debojyoti Dutta
If someone has done it before pleas go ahead else will do it. Sent from my iPhone > On Apr 13, 2016, at 9:06 AM, Elana Hashman > wrote: > > +1 to the IRC bot! > > From: David Lyle > Sent: Wednesday, April 13, 2016 6:30 AM > To: dev@metron.incubator.ap

[DISCUSS] Metron assessment tool

2016-04-13 Thread James Sirota
Prior to adoption of Metron each adopting entity needs to guesstimate it’s data volume and data storage requirements so they can size their cluster properly. I propose a creation of an assessment tool that can plug in to a Kafka topic for a given telemetry and over time produce statistics for i

Re: [DISCUSS] Metron assessment tool

2016-04-13 Thread George Vetticaden
+ 1 to James suggestion. We also need to consider not just the data volume and storage requirements for proper cluster sizing but also processing requirements as well. Given that in the new architecture, we have moved to single enrichment topology that will support all data sources, proper sizing o

Re: [DISCUSS] Metron assessment tool

2016-04-13 Thread James Sirota
Hi George, So the idea here is for the tool to gather the metrics and then either have documentation or some kind of script that crunches through the metrics and produces a configuration recommendation. So what you mention would be the outcome of this analysis. So an example would be if your

Re: [DISCUSS] Metron assessment tool

2016-04-13 Thread George Vetticaden
I have used the following Kafka and Storm Best Practices guide at numerous customer implementations. https://community.hortonworks.com/articles/550/unofficial-storm-and-kafka-b est-practices-guide.html We need to have something similar and prescriptive for Metron based on: 1. What data sources ar

Re: [DISCUSS] Metron assessment tool

2016-04-13 Thread James Sirota
Hi Goerge, This article defines micro-tuning of the existing cluster. What I am proposing is a level up from that. When you start with Metron how do you even know how many nodes you need? And of these nodes how many do you allocate to Storm, indexing, storage? How much storage do you need?

Re: [DISCUSS] Metron assessment tool

2016-04-13 Thread George Vetticaden
Makes sense. -- George VetticadenPrincipal, Senior Product Manager for Metron gvettica...@hortonworks.com (630) 909-9138 On 4/13/16, 12:05 PM, "James Sirota" wrote: >Hi Goerge, > >This article defines micro-tuning of the existing cluster. What I am >proposing is a level up from that. Wh

Re: [DISCUSS] Metron assessment tool

2016-04-13 Thread Nick Allen
If the tool starts at Kafka, the user would have to already have committed to the investment in the infrastructure and time to setup the sensors that feed Kafka and Kafka itself. Maybe it would need to be further upstream? On Apr 13, 2016 1:05 PM, "James Sirota" wrote: > Hi Goerge, > > This arti

Re: [DISCUSS] Metron assessment tool

2016-04-13 Thread James Sirota
That’s an excellent point. So I think there are three ways forward. One is we can assume that there has to be at least a minimal infrastructure in place (at least a subset of Kafka and Storm resources) to run a full-scale assessment. If you point something that blasts millions of messages pe