Loader Configuration

Some pointers on tuning loader machines.

Loader Machine

Temporary Folder

The tempdir setting controls the folder where Truxton ETLs will write their temporary files. In the case of PST files, this can be huge. Choose a fast drive to hold this.

Hashsets

The hashsetdir setting controls the folder where hashsets are stored. Any ETL process that produces files will need fast access to the files in this folder. Many reads will be performed on these files so this folder should be on a fast drive.

Rack Configuration

The Truxton Forensic Rack has a Yellowbrick database appliance, dedicated loader/exploitation machines and depot storage. With everything separated, it gives us many knobs to turn for loading.

Machine IDs

Normally the machine identifier is derived from the operating system but in a rack situation we sacrifice some entropy to provide system administrators assistance. The Machine ID for rack configurations are made up of the following fields:

Field	Length	Meaning
Rack	2 bytes	5452 TR for Truxton Rack
Rack Serial Number	2 bytes	The serial number of the rack in hex encoded decimal
Rack Address Indicator	1 byte	55 U
Rack Address	1 byte	Unit address in the rack of the machine
Logical Processors	2 bytes	The number of logical CPUs in the machine
RAM	2 bytes	The number of gigabytes of RAM in the machine
IP Address	6 bytes	The IP address of the machine

For Example a Rack Machine ID of 54520001-5501-0072-0191-010010182131 tells us:

Bytes	Meaning
5452	ASCII TR, this is a Rack Machine ID
0001	Serial Number 1
55	Unit Address
01	The machine is in slot U01 in the rack
0072	The machine has 72 logical processors
0191	The machine has 191GB of RAM
010010182131	The IP address of the machine is 10.10.182.131

The Machine ID corresponds to the MachineID column of the Statistics table. This allows you to see how the different machines perform their loads.

Loader Node Configuration Files

A pair of configuration files TruxtonSettings.xml and TruxtonService.xml are created and saved to make installation easy on virgin machines. TruxtonSettings.xml identifies the loader node and where the database and depots are. TruxtonService.xml governs which ETL processes will run on that machine.

Loader Node Installation Checklist

Here are the steps for installing Truxton as a loader node on the rack.

1. Make sure FIPS mode is off
2. Create C:\ProgramData\Truxton\Settings folder
3. Copy the two configuration files into the Settings folder
4. Modify the TruxtonSettings.xml file to set the machineid, set the rack and IP address fields
5. Install Truxton
6. Stop the Truxton service
7. Stop Les
8. Set Les (Truxton Monitor) server to be Disabled
9. Create D:\Hashsets folder
10. Copy the hashsets from the installation media to D:\Hashsets
11. Restart the Truxton service