Loader Configuration

Some pointers on tuning loader machines.

Loader Machine

Temporary Folder

The tempdir setting controls the folder where Truxton ETLs will write their temporary files. In the case of PST files, this can be huge. Choose a fast drive to hold this.

Hashsets

The hashsetdir setting controls the folder where hashsets are stored. Any ETL process that produces files will need fast access to the files in this folder. Many reads will be performed on these files so this folder should be on a fast drive.

Rack Configuration

The Truxton Forensic Rack has a Yellowbrick database appliance, dedicated loader/exploitation machines and depot storage. With everything separated, it gives us many knobs to turn for loading.

U42	Network Switch
U27	Yellowbrick
U26	Yellowbrick Manager 0
U25	Yellowbrick Manager 1
U23	KVM Server
U22	Keyboard and Monitor
U13	Loader 7
U11	Loader 6
U09	Loader 5
U07	Loader 4
U05	Loader 3
U03	Loader 2
U01	Loader 1

Machine IDs

Normally the machine identifier is derived from the operating system but in a rack situation we sacrifice some entropy to provide system administrators assistance. The Machine ID for rack configurations are made up of the following fields:

Field	Length	Meaning
Rack	2 bytes	5452 TR for Truxton Rack
Rack Serial Number	2 bytes	The serial number of the rack in hex encoded decimal
Rack Address Indicator	1 byte	55 U
Rack Address	1 byte	Unit address in the rack of the machine
Logical Processors	2 bytes	The number of logical CPUs in the machine
RAM	2 bytes	The number of gigabytes of RAM in the machine
IP Address	6 bytes	The IP address of the machine

For Example a Rack Machine ID of 54520001-5501-0072-0191-010010182131 tells us:

Bytes	Meaning
5452	ASCII TR, this is a Rack Machine ID
0001	Serial Number 1
55	Unit Address
01	The machine is in slot U01 in the rack
0072	The machine has 72 logical processors
0191	The machine has 191GB of RAM
010010182131	The IP address of the machine is 10.10.182.131

The Machine ID corresponds to the MachineID column of the Statistics table. This allows you to see how the different machines perform their loads.

Loader Node Configuration Files

A pair of configuration files TruxtonSettings.xml and TruxtonService.xml are created and saved to make installation easy on virgin machines. TruxtonSettings.xml identifies the loader node and where the database and depots are. TruxtonService.xml governs which ETL processes will run on that machine.

Loader Node Installation Checklist

Here are the steps for installing Truxton as a loader node on the rack. We recommend that each loader node have an SSD dedicated to Truxton. This SSD, we will call it the D: drive, can be in the 200GB range or larger. Truxton will use it to host the hashsets and for temporary files. We do this because hashsets require a lot of seek and reads. If it is on an SSD, the speed will be dramatically improved over having it on a shared folder. Likewise, the temporary files folder should be on an SSD for improved IO performance.

1. Make sure FIPS mode is off
2. Create C:\ProgramData\Truxton\Settings folder
3. Copy the two configuration files into the Settings folder
4. Modify the TruxtonSettings.xml file to set the machineid, set the rack and IP address fields
5. Install Truxton
   1. Do not install Java
   2. Do not install PostgreSQL
   3. Yes install with the default options (since we copied the settings files already)
6. Stop the Truxton service
7. Stop Les
8. Set Les (Truxton Monitor) service to be Disabled
9. Create D:\Hashsets folder
10. Create the D:\Temp folder
11. Remove permissions from D:\Temp so the ETL processes can write to it.
12. Copy the hashsets from the installation media to D:\Hashsets
13. Restart the Truxton service