---
# System prepended metadata

title: System Layout

---


# System Layout

RAIN consists of two systems, the target host, which is the machine being monitored and a analysis server. The analysis server is responsible for generating the audit logs used for downstream analysis.

On the host machine (`kacb3110d13/theia`) you can run the command: 

```
virsh list --all
 Id    Name                           State
----------------------------------------------------
 2     e5-analysis                    running
 13    ubuntu12.04                    running
 -     e5-target                      shut off
 -     generic                        shut off

```

Currently, the `ubuntu12.04` vm is the target machine and the `e5-analysis` vm is the analysis host. Additionally, for the remainder of this writeup, we will reference the host machine as `theia`.



# Setting up logging on the target machine.

From the `theia` box you can log into the target machine using the following command. The password for the target machine is theia.

```
ssh theia@192.168.123.7
```

Next, you will need to start the `relay-read-file` process, which is responsible for writing the audit logs to disk.

```
sudo relay-read-file &
```

Once `relay-read-file` is running, you can turn on the logging with the following commands:

RAIN currently supports 1 CPU.
```
 sudo ./disable_cores.sh 
```

Finally, you can turn on the logging:

```
 echo 1 | sudo tee /sys/kernel/theia/theia_logging_toggle 
```

In order to verify the logging is running, you can verify that the output file size is increasing:

```
ls -al /data/ahg.dump.7.1
-rw-r--r--   1 root  root  921457 May 15 15:35 ahg.dump.7.1
```

Finally, in order to turn the logging off you can run the command:

```
echo 0 | sudo tee /sys/kernel/theia/theia_logging_toggle
```


# Converting the audit logs into CDM format.

From the `theia` box, log into the `analysis server`. The password is `darpatheia1`.

```
ssh theia@192.168.123.6
```

Next, you need to run the following command to generate the CDM data for the audit logs:

```
sudo ahg_queue_file -c /etc/theia/handler.cfg
```

This will generate the file:

```
cdm-data.bin
```

__NOTE__: The ahg_queue_file application is designed such that it runs an infinite loop, in order to keep processing incoming logs. However, since you are using it on a file that is static, you will need to use `Ctl-C` to kill the application.

In order to determine if the ahg_queue_file is finished processing the data, it will be spamming the following output:

```
%7|1590692309.267|BUFQ|query-ta1-theia-e3-12#producer-1| [thrd:localhost:9092/bootstrap]: localhost:9092/bootstrap: Updating 0 buffers on connection reset
```

Once you see this, you can kill the application.


The final step is converting this data into a JSON format:

```
java -jar avro-tools-1.8.2.jar tojson cdm-data.bin  > cdm-data.json
```

The output file will be stored in `cdm-data.json`



## Rerunning the logging

The easiest method to rerun the logging is to delete the file `/data/ahg.dump.*` and rebooting the target machine. 


However, if you do not want to restart the machine you need to stop the `relay-read-file` application and then delete or move the file `/data/ahg.dump.*`. Once this is complete, you can rerun the commands discussed previously.:

Restarting relay-read-file application:

```
sudo kill -s 15 $(pgrep -f relay-read-file)
```


