Configuration

There are 2 configuration files, config.sh and ENTRADA-settings.properties. All the required configuration options are mentioned in the installation manual.

config.sh

The config.sh configuration file mainly contains options for data input/output paths, name servers and security.

Option Description
ENTRADA_HOME home directory of ENTRADA application files
TMP_DIR The directory where ENTRADA state is kept
IMPALA_NODE Impala deamon hostname for impala-shell to connect to
HDFS_HOME hdfs root directory, data is stored below this root
DATA_RSYNC_DIR root directory for name server pcap files (each sub directory must named as a name server)
DATA_DIR root directory for processing pcap files (includes archive)
PCAP_DAYS_TO_KEEP The number of days processed pcap files are archived
DELETE_INPUT_PCAP_FILES if true then pcap files are deleted from DATA_RSYNC_DIR after they are picked up
ENTRADA_LOG_DIR location for log files
NAMESERVERS seperate multiple name servers with a colon ("ns1;ns2")
ENTRADA_JAR path to the Entrada jar file
KRB_USER if Kerberos is used, then supply Kerberos user to use. (username@REALM)
KEYTAB_FILE if Kerberos is used, then supply a Kerberos keytab file
ERROR_MAIL e-mail address to send error-mail to

ENTRADA-settings.properties

The ENTRADA-settings.properties configuration file is used pcap-to-parquet process.

Option Description
output.max.packets max number of packets for each Parquet file
cache.timeout timeout for cached DNS packets (seconds)
resolver.list.google URL to Google resolver IP addresses
resolver.list.opendns URL to OpenDNS resolvers IP addresses
graphite.prefix prefix to add to Graphite metric names
graphite.host hostname of the Graphite server
graphite.port portnumber of the Graphite server
graphite.connect.timeout timeout while connecting to Graphite server
graphite.retention Graphite retention for realtime DNS queries
graphite.threshhold DNS query counts below the threshhold are not sent to Graphite

For information about Graphite retention see: Graphite rentention