Trisul is a streaming analytics system where the metrics have to be defined beforehand.

Sometimes a new release of Trisul introduces extra metrics. These metrics will be available to all contexts created AFTER the release, but those contexts already running will not be able to see the new metrics.

In this HOWTO we describe a tool called webtrisul:addmeter that can be used to add metrics to existing contexts. Note that you cannot delete a metric

Example

A new release of Trisul introduces two new meters in the Hosts and Apps counter group to track the activity relative to a Netflow Router Interface.

Here is how you can update an already running context to use the new metrics using the addmeter tool

New Meter Name : Into Interface Meter ID = 14 Meter Type = RATE_COUNTER (4) Top Count = 20,

Run the following to update the default context and profile to update the Host Counter group and all counters derived from it (such as Internal Hosts, DNS Hosts, Hosts on Router Interface, etc etc)

rake webtrisul:addmeter[context0,profile0,{4CD742B1-C1CA-4708-BE78-0FCA2EB01A86},14,4,20,"bps","Into  Interface","Bps"]

rake webtrisul:addmeter[context0,profile0,{4CD742B1-C1CA-4708-BE78-0FCA2EB01A86},15,4,20,"bps","Out of Interface","Bps"]

then for the Apps counter group , do the following (note change in counter guid and the meter IDs. We use meter id 8 and 9 here)

rake webtrisul:addmeter[context0,profile0,{C51B48D4-7876-479E-B0D9-BD9EFF03CE2E},8,4,20,"bps","Into Interface","Bps"]

rake webtrisul:addmeter[context0,profile0,{C51B48D4-7876-479E-B0D9-BD9EFF03CE2E},9,4,20,"bps","Out of Interface","Bps"]

Then restart the context. You should be seeing the new metrics.

Machineid inside container

How to Reset Web Admin Password

How to Reset Web User Password

Export / Import IPV6 Host Labels

Suricata Error 'enp2s0': Operation not permitted

New app to scan FireHOL IP Crime list

How to add new meters to Trisul