Loader Configuration
Some pointers on tuning loader machines.
Loader Machine
Temporary Folder
The tempdir setting controls the folder where Truxton ETLs will write their temporary files.
In the case of PST files, this can be huge.
Choose a fast drive to hold this.
Hashsets
The hashsetdir setting controls the folder where hashsets are stored.
Any ETL process that produces files will need fast access to the files in this folder.
Many reads will be performed on these files so this folder should be on a fast drive.
Rack Configuration
The Truxton Forensic Rack has a Yellowbrick database appliance, dedicated loader/exploitation machines and depot storage. With everything separated, it gives us many knobs to turn for loading.
Machine IDs
Normally the machine identifier is derived from the operating system but in a rack situation we sacrifice some entropy to provide system administrators assistance. The Machine ID for rack configurations are made up of the following fields:
| Field | Length | Meaning |
|---|---|---|
| Rack | 2 bytes | 5452 TR for Truxton Rack
|
| Rack Serial Number | 2 bytes | The serial number of the rack in hex encoded decimal |
| Rack Address Indicator | 1 byte | 55 U
|
| Rack Address | 1 byte | Unit address in the rack of the machine |
| Logical Processors | 2 bytes | The number of logical CPUs in the machine |
| RAM | 2 bytes | The number of gigabytes of RAM in the machine |
| IP Address | 6 bytes | The IP address of the machine |
For Example a Rack Machine ID of 54520001-5501-0072-0191-010010182131 tells us:
| Bytes | Meaning |
|---|---|
5452
|
ASCII TR, this is a Rack Machine ID |
0001
|
Serial Number 1 |
55
|
Unit Address |
01
|
The machine is in slot U01 in the rack |
0072
|
The machine has 72 logical processors |
0191
|
The machine has 191GB of RAM |
010010182131
|
The IP address of the machine is 10.10.182.131 |
The Machine ID corresponds to the MachineID column of the Statistics table.
This allows you to see how the different machines perform their loads.
