Docs Home User Guide

Contents

Trisul Contexts

You can run multiple instances of Trisul looking at different types of data. Each of these instances store their metering and forensics information in a separate area. We call each of these instances Contexts.

Some applications of Trisul Contexts

  • One context for eth0 and another for eth1
  • One context processes raw packets, and another processes Netflow
  • One context for Office-A another for Office-B and yet another combined Office-A and B

How to create a new Trisul ContextTop

Run mknewcontext

Select a context name and use the mknewcontext script to create the new context.

cd /usr/local/share/trisul
./mknewcontext

give it a context name. The name must be all lowercase alpha numeric.

The mknewcontext script will create a new config file /usr/local/etc/trisul/trisulConfig_mynewcontext.xml and all the required directories pointing to the right places. You can tweak the new config file to match your needs.

Initialize the new context

Use the cleanenv script to initialize the context.

./cleanenv -f -init -c mynewcontext

Enable the web interface for the new context

Select Admin → Contexts
  1. Create the new context
  2. Logout
  3. Re-login after selecting the new context from the drop down box

Running a new contextTop

Start/Stop

At login time, you have to select which context you want to work with. After that, you can start / stop Trisul daemon using the same methods.

From the web via Admin → Start/Stop Tasks → Start Trisul

Automatically start the new context on bootup

Just copy the init script

/etc/init.d/trisul file to /etc/init.d/trisul_mynewcontext

Then change the configuration file inside to

/usr/local/etc/trisul/trisulConfig_mynewcontext.xml

After this you use the standard Linux tools to start

To start from command line

# on centos
service trisul_mynewcontext start
# on Ubuntu
/etc/init.d/trisul_mynewcontext start

To start automatically

# centos
chkconfig add trisul_mynewcontext
# ubuntu
cd /etc/init.d/
update-rc.d trisul_mynewcontext defaults

Deleting a contextTop

You can delete a context from the web interface

  1. Login as admin into a different context (say the Primary context)
  2. Goto Admin → Contexts, then select Delete and confirm

To cleanup, remove all data from a context. You can use the cleanenv tool

cd /usr/local/share/trisul
./cleanenv -f -c  my_network_1