Difference between revisions of "Loader Configuration"
| Line 94: | Line 94: | ||
==Loader Node Installation Checklist== | ==Loader Node Installation Checklist== | ||
Here are the steps for installing Truxton as a loader node on the rack. | Here are the steps for installing Truxton as a loader node on the rack. | ||
| + | We recommend that each loader node have an SSD dedicated to Truxton. | ||
| + | This SSD, we will call it the <code>D:</code> drive, can be in the 200GB range or larger. | ||
| + | Truxton will use it to host the [[Hash Set|hashsets]] and for temporary files. | ||
| + | We do this because hashsets require a lot of seek and reads. | ||
| + | If it is on an SSD, the speed will be dramatically improved over having it on a shared folder. | ||
| + | Likewise, the temporary files folder should be on an SSD for improved IO performance. | ||
# Make sure FIPS mode is off | # Make sure FIPS mode is off | ||
| Line 104: | Line 110: | ||
# Set Les (Truxton Monitor) server to be Disabled | # Set Les (Truxton Monitor) server to be Disabled | ||
# Create <code>D:\Hashsets</code> folder | # Create <code>D:\Hashsets</code> folder | ||
| + | # Create the <code>D:\Temp</code> folder | ||
# Copy the hashsets from the installation media to <code>D:\Hashsets</code> | # Copy the hashsets from the installation media to <code>D:\Hashsets</code> | ||
# Restart the Truxton service | # Restart the Truxton service | ||
Revision as of 16:38, 20 August 2020
Some pointers on tuning loader machines.
Contents
Loader Machine
Temporary Folder
The tempdir setting controls the folder where Truxton ETLs will write their temporary files.
In the case of PST files, this can be huge.
Choose a fast drive to hold this.
Hashsets
The hashsetdir setting controls the folder where hashsets are stored.
Any ETL process that produces files will need fast access to the files in this folder.
Many reads will be performed on these files so this folder should be on a fast drive.
Rack Configuration
The Truxton Forensic Rack has a Yellowbrick database appliance, dedicated loader/exploitation machines and depot storage. With everything separated, it gives us many knobs to turn for loading.
Machine IDs
Normally the machine identifier is derived from the operating system but in a rack situation we sacrifice some entropy to provide system administrators assistance. The Machine ID for rack configurations are made up of the following fields:
| Field | Length | Meaning |
|---|---|---|
| Rack | 2 bytes | 5452 TR for Truxton Rack
|
| Rack Serial Number | 2 bytes | The serial number of the rack in hex encoded decimal |
| Rack Address Indicator | 1 byte | 55 U
|
| Rack Address | 1 byte | Unit address in the rack of the machine |
| Logical Processors | 2 bytes | The number of logical CPUs in the machine |
| RAM | 2 bytes | The number of gigabytes of RAM in the machine |
| IP Address | 6 bytes | The IP address of the machine |
For Example a Rack Machine ID of 54520001-5501-0072-0191-010010182131 tells us:
| Bytes | Meaning |
|---|---|
5452
|
ASCII TR, this is a Rack Machine ID |
0001
|
Serial Number 1 |
55
|
Unit Address |
01
|
The machine is in slot U01 in the rack |
0072
|
The machine has 72 logical processors |
0191
|
The machine has 191GB of RAM |
010010182131
|
The IP address of the machine is 10.10.182.131 |
The Machine ID corresponds to the MachineID column of the Statistics table.
This allows you to see how the different machines perform their loads.
Loader Node Configuration Files
A pair of configuration files TruxtonSettings.xml and TruxtonService.xml are created and saved to make installation easy on virgin machines.
TruxtonSettings.xml identifies the loader node and where the database and depots are.
TruxtonService.xml governs which ETL processes will run on that machine.
Loader Node Installation Checklist
Here are the steps for installing Truxton as a loader node on the rack.
We recommend that each loader node have an SSD dedicated to Truxton.
This SSD, we will call it the D: drive, can be in the 200GB range or larger.
Truxton will use it to host the hashsets and for temporary files.
We do this because hashsets require a lot of seek and reads.
If it is on an SSD, the speed will be dramatically improved over having it on a shared folder.
Likewise, the temporary files folder should be on an SSD for improved IO performance.
- Make sure FIPS mode is off
- Create
C:\ProgramData\Truxton\Settingsfolder - Copy the two configuration files into the Settings folder
- Modify the
TruxtonSettings.xmlfile to set themachineid, set the rack and IP address fields - Install Truxton
- Stop the Truxton service
- Stop Les
- Set Les (Truxton Monitor) server to be Disabled
- Create
D:\Hashsetsfolder - Create the
D:\Tempfolder - Copy the hashsets from the installation media to
D:\Hashsets - Restart the Truxton service
