Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)
| PUT _ingest/pipeline/moloch-ecs | |
| { | |
| "description": "Ingest Moloch indices in ECS format.", | |
| "processors": [ | |
| { | |
| "rename": { | |
| "field": "dstIp", | |
| "target_field": "destination.ip", | |
| "description": "DESTINATION IP", | |
| "ignore_missing": true, |
You can use ssacli (smart storage administrator command line interface) tool to manage any of supported HP Smart Array Controllers in your Proxmox host without need to reboot your server to access Smart Storage Administrator in BIOS. That means no host downtime when managing your storage.
CLI is not as convenient as GUI interface provided by BIOS or desktop utilities, but still allows you to fully manage your controller, physical disks and logical drives on the fly with no Proxmox host downtime.
ssacli replaces older hpssacli, but shares the same syntax and adds support for newer servers and controllers.
| PATTERNS_GLOB = ENV['PATTERNS_GLOB'] || '~/work/elastic/plugins/logstash-patterns-core/patterns/*' | |
| FIELD_MATCHER = /{\w+:([^}]+)}/ | |
| ECS = %w(labels agent client cloud container destination ecs error event file | |
| geo group host http log network observer organization os process | |
| related server service source url user user_agent) | |
| field_names = {} | |
| puts "File name\tField\tLine\tPosition\tConflict" | |
| Dir[PATTERNS_GLOB].each do |file| |
All these are already installed on epyc.
kafkacat (conda install -c conda-forge kafkacat)
kt (grab it from https://github.com/fgeller/kt/releases)
kafka-* (come with kafka, if you yum install if from Confluent's repo, or via Docker if you're so inclined). Warning -- JVM based and dreadfully slow.
jq (conda install -c conda-forge jq or use your favorite package manager)
| Producer | |
| Setup | |
| bin/kafka-topics.sh --zookeeper localhost:2181/kafka-local --create --topic test-rep-one --partitions 6 --replication-factor 1 | |
| bin/kafka-topics.sh --zookeeper localhost:2181/kafka-local --create --topic test-rep-two --partitions 6 --replication-factor 3 | |
| Single thread, no replication | |
| bin/kafka-run-class.sh org.apache.kafka.tools.ProducerPerformance --print-metrics --topic test-rep-one --num-records 6000000 --throughput 100000 --record-size 100 --producer-props bootstrap.servers=kafka_host:9092 buffer.memory=67108864 batch.size=8196 | |
| Single-thread, async 3x replication |
| [Unit] | |
| Description=scirius daemon | |
| After=network.target | |
| [Service] | |
| User=www-data | |
| Group=www-data | |
| WorkingDirectory=/usr/share/python/scirius | |
| ExecStart=/usr/share/python/scirius/bin/gunicorn --log-syslog -t 600 -w 4 --bind unix:/tmp/scirius.sock scirius.wsgi:application | |
| Environment=VIRTUAL_ENV=/usr/share/python/scirius | |
| Environment=GIT_PYTHON_GIT_EXECUTABLE=/usr/bin/git |
| filter { | |
| # Analyze access log | |
| if [fields][type] == "apache-access" { | |
| # First part: get every common message | |
| grok { | |
| match => { "message" => "^%{IP:[apache2][access][remote_ip]} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] " } | |
| overwrite => "message" | |
| } | |
| # Get the specifics |
| # Alert when the rate of events exceeds a threshold | |
| # (Required) | |
| # Rule name, must be unique | |
| name: OutOfMemoryError | |
| # (Required) | |
| # Type of alert. | |
| # the frequency rule type alerts when num_events events occur with timeframe time | |
| type: frequency |
Requirements:
Steps to setup the scripts:
mkdir benches
cd benches
curl https://artifacts.elastic.co/downloads/logstash/logstash-7.6.0.tar.gz | tar -zxf -
cd logstash-7.6.0