Difference between revisions of "Loader Configuration"

From truxwiki.com
Jump to navigation Jump to search
Line 16: Line 16:
 
The Truxton Forensic Rack has a [https://www.yellowbrick.com/ Yellowbrick] database appliance, dedicated loader/exploitation machines and depot storage.
 
The Truxton Forensic Rack has a [https://www.yellowbrick.com/ Yellowbrick] database appliance, dedicated loader/exploitation machines and depot storage.
 
With everything separated, it gives us many knobs to turn for loading.
 
With everything separated, it gives us many knobs to turn for loading.
 +
 +
==Machine IDs==
 +
Normally the machine identifier is derived from the [[truxton get_machine_id#Remarks|operating system]] but in a rack situation we sacrifice some entropy to provide system administrators assistance.
 +
The Machine ID for rack configurations are made up of the following fields:
 +
 +
{| class="wikitable"
 +
|-
 +
! Field
 +
! Length
 +
! Meaning
 +
|-
 +
| Rack
 +
| 2 bytes
 +
| <code>5452</code> TR for Truxton Rack
 +
|-
 +
| Rack Serial Number
 +
| 2 bytes
 +
| The serial number of the rack in hex encoded decimal
 +
|-
 +
| Rack Address Indicator
 +
| 1 byte
 +
| <code>55</code> U
 +
|-
 +
| Rack Address
 +
| 1 byte
 +
| Unit address in the rack of the machine
 +
|-
 +
| Logical Processors
 +
| 2 bytes
 +
| The number of logical CPUs in the machine
 +
|-
 +
| RAM
 +
| 2 bytes
 +
| The number of gigabytes of RAM in the machine
 +
|-
 +
| IP Address
 +
| 6 bytes
 +
| The IP address of the machine
 +
|}
 +
 +
For Example a Rack Machine ID of <code>54520001-5501-0072-0191-010010182131</code> tells us:
 +
{| class="wikitable"
 +
|-
 +
! Bytes
 +
! Meaning
 +
|-
 +
| <code>5452</code>
 +
| ASCII TR, this is a Rack Machine ID
 +
|-
 +
| <code>0001</code>
 +
| Serial Number 1
 +
|-
 +
| <code>55</code>
 +
| Unit Address
 +
|-
 +
| <code>01</code>
 +
| The machine is in slot U01 in the rack
 +
|-
 +
| <code>0072</code>
 +
| The machine has 72 logical processors
 +
|-
 +
| <code>0191</code>
 +
| The machine has 191GB of RAM
 +
|-
 +
| <code>010010182131</code>
 +
| The IP address of the machine is 10.10.182.131
 +
|}

Revision as of 07:16, 20 August 2020

Some pointers on tuning loader machines.

Loader Machine

Temporary Folder

The tempdir setting controls the folder where Truxton ETLs will write their temporary files. In the case of PST files, this can be huge. Choose a fast drive to hold this.

Hashsets

The hashsetdir setting controls the folder where hashsets are stored. Any ETL process that produces files will need fast access to the files in this folder. Many reads will be performed on these files so this folder should be on a fast drive.

Rack Configuration

The Truxton Forensic Rack has a Yellowbrick database appliance, dedicated loader/exploitation machines and depot storage. With everything separated, it gives us many knobs to turn for loading.

Machine IDs

Normally the machine identifier is derived from the operating system but in a rack situation we sacrifice some entropy to provide system administrators assistance. The Machine ID for rack configurations are made up of the following fields:

Field Length Meaning
Rack 2 bytes 5452 TR for Truxton Rack
Rack Serial Number 2 bytes The serial number of the rack in hex encoded decimal
Rack Address Indicator 1 byte 55 U
Rack Address 1 byte Unit address in the rack of the machine
Logical Processors 2 bytes The number of logical CPUs in the machine
RAM 2 bytes The number of gigabytes of RAM in the machine
IP Address 6 bytes The IP address of the machine

For Example a Rack Machine ID of 54520001-5501-0072-0191-010010182131 tells us:

Bytes Meaning
5452 ASCII TR, this is a Rack Machine ID
0001 Serial Number 1
55 Unit Address
01 The machine is in slot U01 in the rack
0072 The machine has 72 logical processors
0191 The machine has 191GB of RAM
010010182131 The IP address of the machine is 10.10.182.131
Retrieved from "https://truxwiki.com/index.php?title=Loader_Configuration&oldid=2174"