search

flyballlabs / threatdetectionservice

Threat Management Platform with Apache Metron as the core engine
Apache License 2.0
6 stars 3 forks source link

Metron won't enrich threat intel #22

Open devopsec opened 7 years ago

devopsec commented 7 years ago

Can not get metron to enrich threat intel via threat intel bulk loader. When I try the threat intel bulk load cmd zookeeper hangs at connection, see output below:

2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:java.library.path=/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:java.io.tmpdir=/tmp 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:java.compiler= 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:os.name=Linux 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:os.arch=amd64 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:os.version=2.6.32-642.6.2.el6.x86_64 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:user.name=root 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:user.home=/root 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:user.dir=/assets-hosts 2017-01-16 02:38:57,726 INFO [main] zookeeper.ZooKeeper: Initiating client connection, connectString=node1:2181 sessionTimeout=90000 watcher=hconnection-0x4671115f0x0, quorum=node1:2181, baseZNode=/hbase-unsecure 2017-01-16 02:38:57,747 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Opening socket connection to server node1/192.168.66.121:2181. Will not attempt to authenticate using SASL (unknown error) 2017-01-16 02:38:57,754 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Socket connection established to node1/192.168.66.121:2181, initiating session 2017-01-16 02:38:57,756 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Unable to read additional data from server sessionid 0x0, likely server has closed socket, closing socket connection and attempting reconnect 2017-01-16 02:38:57,861 WARN [main] zookeeper.RecoverableZooKeeper: Possibly transient ZooKeeper, quorum=node1:2181, exception=org.apache.zookeeper.KeeperException$ConnectionLossException: KeeperErrorCode = ConnectionLoss for /hbase-unsecure/hbaseid 2017-01-16 02:38:59,233 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Opening socket connection to server node1/192.168.66.121:2181. Will not attempt to authenticate using SASL (unknown error) 2017-01-16 02:38:59,234 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Socket connection established to node1/192.168.66.121:2181, initiating session 2017-01-16 02:38:59,234 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Unable to read additional data from server sessionid 0x0, likely server has closed socket, closing socket connection and attempting reconnect 2017-01-16 02:38:59,334 WARN [main] zookeeper.RecoverableZooKeeper: Possibly transient ZooKeeper, quorum=node1:2181, exception=org.apache.zookeeper.KeeperException$ConnectionLossException: KeeperErrorCode = ConnectionLoss for /hbase-unsecure/hbaseid 2017-01-16 02:39:01,153 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Opening socket connection to server node1/192.168.66.121:2181. Will not attempt to authenticate using SASL (unknown error) 2017-01-16 02:39:01,153 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Socket connection established to node1/192.168.66.121:2181, initiating session 2017-01-16 02:39:01,155 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Unable to read additional data from server sessionid 0x0, likely server has closed socket, closing socket connection and attempting reconnect

After replacing the ojdbc.jar file mentioned in the error zookeeper client is unable to connect. See below:

2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:java.library.path=/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:java.io.tmpdir=/tmp 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:java.compiler= 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:os.name=Linux 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:os.arch=amd64 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:os.version=2.6.32-642.6.2.el6.x86_64 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:user.name=root 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:user.home=/root 2017-01-16 02:38:57,725 INFO [main] zookeeper.ZooKeeper: Client environment:user.dir=/assets-hosts 2017-01-16 02:38:57,726 INFO [main] zookeeper.ZooKeeper: Initiating client connection, connectString=node1:2181 sessionTimeout=90000 watcher=hconnection-0x4671115f0x0, quorum=node1:2181, baseZNode=/hbase-unsecure 2017-01-16 02:38:57,747 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Opening socket connection to server node1/192.168.66.121:2181. Will not attempt to authenticate using SASL (unknown error) 2017-01-16 02:38:57,754 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Socket connection established to node1/192.168.66.121:2181, initiating session 2017-01-16 02:38:57,756 INFO [main-SendThread(node1:2181)] zookeeper.ClientCnxn: Unable to read additional data from server sessionid 0x0, likely server has closed socket, closing socket connection and attempting reconnect 2017-01-16 02:38:57,861 WARN [main] zookeeper.RecoverableZooKeeper: Possibly transient ZooKeeper, quorum=node1:2181, exception=org.apache.zookeeper.KeeperException$ConnectionLossException: KeeperErrorCode = ConnectionLoss for /hbase-unsecure/hbaseid