ECA (Eyeglass Clustered Agent) CLI Commands

Introduction

The Eyeglass Clustered Agent (ECA) runs Data Security features (Easy Auditor, Ransomware Defender) as a set of Docker containers distributed across ECA nodes. The ecactl command line tool manages the ECA cluster, its containers, and the underlying services (Kafka, ZooKeeper, HBase). These commands are run from an SSH session to an ECA node.

Kafka Commands

ecactl zk --help

Lists available commands for ZooKeeper.

ecactl zk shell

Opens a ZooKeeper shell.

ls /superna/eca/turboaudit

Lists sub-folders to check status.

ls /superna/eca/turboaudit/ecanodes

ls /superna/eca/turboaudit/auditfolders

Lists the cluster folders. Select a folder name with /owner and use the get command to find the ECA node assigned to that audit folder.

Example:

get /superna/eca/turboaudit/auditfolders/00505698f0793f8bbb56fc176e2f7b6e204c_node001/owner

ecactl kafka topics --help

Lists the available flags for Kafka.

ecactl kafka topics --describe

Returns information about all Kafka topics. If these commands do not error out, this can be considered a successful test.

ecactl cluster services list

Lists each node and the services running on that node in the distributed cluster (different services run on different nodes).

Basic ECA Commands

Start ECA Cluster

ecactl cluster up

Stop ECA Cluster

ecactl cluster down

Check ECA Container Logs

ecactl logs <CONTAINER>

Tail the container logs:

ecactl logs --follow <CONTAINER>

Tail a specific number of lines (e.g. last 100):

ecactl logs --follow --tail 100 <CONTAINER>

Combine with grep:

ecactl logs --follow --tail 100 <CONTAINER> | grep -i '<KEYWORD>'

Combine multiple container logs with egrep:

ecactl logs <CONTAINER> <CONTAINER> | egrep -i '<KEYWORD>|<KEYWORD>'

Login to ECA Container

ecactl containers exec <CONTAINER> /bin/bash

ECA Cluster-Wide Log

ecactl cluster exec 'ecactl logs --follow --tail <CONTAINER>'

Run a Script Cluster-Wide

ecactl cluster exec '/opt/superna/eca/scripts/<SCRIPT_NAME>.sh'

Restart ECA Containers Cluster-Wide

ecactl cluster exec 'ecactl containers restart <CONTAINER>'

Take Down a Single ECA Node's Containers

Log in to the specific ECA node (where "X" represents the node ID), then:

ecactl containers down

To bring the ECA containers back up, log in to the ECA master node (node 1):

ecactl cluster up

Run Components Install ECA

Needed before the first cluster up (2.5.4+):

ecactl components install eca

Get a List of ECA Containers and Container Stats

ecactl containers ps
ecactl cluster status

Stop a Specific ECA Container

ecactl containers stop <CONTAINER>

Remove a Container

ecactl containers rm -f <CONTAINER>

Restart a Container

ecactl containers restart <CONTAINER>

Start a Container

ecactl containers up -d <CONTAINER>

Delete and Re-Add a Container (or List of Containers)

info

2.5.5+ introduces a simplified command:

ecactl cluster services restart --container <CONTAINER>
ecactl cluster services restart --all --container <CONTAINER>

The second form restarts the container on all nodes. Under the hood, this runs:

ecactl containers stop <CONT> && ecactl containers rm -f <CONT> && ecactl containers up -d <CONT>

Check ECA Cluster-Wide Service Status

ecactl cluster exec "systemctl status autofs"

Combine ECA Cluster-Wide Commands

ecactl cluster exec '<COMMAND>' && ecactl cluster exec '<COMMAND>'

Example:

ecactl cluster exec 'docker system df -v' && ecactl cluster exec 'docker stats -a --no-stream'

ECA Disk Usage Check

ecactl cluster exec "df -h"

Combine with grep (e.g. to show ZK RAM disk mount information):

ecactl cluster exec "df -h | grep -i zk*"

ECA Cluster-Wide Disk I/O Check

ecactl cluster exec 'iostat -xyz'

Useful ECA Commands

Run the same command across all ECA nodes:

ecactl cluster exec "<command>"
ecactl cluster exec 'top -n 1 | grep -i "kib"'

Other examples:

ecactl cluster exec 'sudo mount -a'
ecactl cluster exec 'sudo umount -l /opt/superna/mnt/audit/<GUID>/<clusterName>'
ecactl cluster exec 'sudo systemctl mask autofs'
ecactl cluster exec 'sudo systemctl restart docker'
ecactl cluster exec 'docker network ls | grep -i node*'
ecactl cluster exec '/opt/superna/eca/scripts/delete_network.sh'

Check HBase Health for Inconsistencies

ecactl containers exec hbase-master /bin/bash
bin/hbase hbck

Check Fastanalysis Container File for Extension

ecactl containers exec fastanalysis /bin/bash
cat ransomwareFilters.json

Run ECA Container in Debug Mode

ecactl containers stop <container_name>
ecactl containers rm -f <container_name>
ecactl containers up -d <container_name> --debug
ecactl logs --follow <container_name>

Update NTP Settings from Master to Other Nodes

info

Requires ECA version 2.9.0 or later.

Add the following to /opt/superna/eca/eca-env-common.conf (IP or FQDN):

export NTP_SERVERS=<your NTP server IP or FQDN>

Then run:

ecactl cluster up --config-ntp-server

This adds the entries from the NTP_SERVERS environment variable and syncs the chronyd services across all nodes.

Schedule Cron to Restart Containers

ecactl cluster exec "sudo -E ecactl components restart-cron set fastanalysis,evtarchive,turboaudit 0 0,6,12,18 '*' '*' '*'"

This sets cron on three containers using the cron string shown above. This is the default cron string that should be used.

note

The outer double quotes are required for the ecactl cluster exec command. A password for each node will be required.

General form:

sudo -E ecactl components restart-cron set <container>[,<container>[...]] <cron interval>

To remove the cron setting for one or more containers:

sudo -E ecactl components restart-cron remove <container>[,<container>[...]]

note

This can be executed on a single node.