# POP-LCP Node Notes.md

## How to download ova file in AWS S3 

Use the S3 pre-signed URL ( they expire in 1 hour! )
`AWS_PROFILE=mdr-common-services-gov aws s3 presign s3://afsxdr-binaries/LCP/vmware/lcp-vmware-20201117.ova --expires-in 604800`

## Create HD

SDC drive
 3014  03/20/20 19:41:43 +0000 salt 'afs*syslog-[5678]*' cmd.run 'pvcreate /dev/sdc'
 3015  03/20/20 19:42:08 +0000 salt 'afs*syslog-[5678]*' cmd.run 'vgcreate vg_syslog /dev/sdc'
 3016  03/20/20 19:42:42 +0000 salt 'afs*syslog-[5678]*' cmd.run 'lvcreate -n lv_syslog'
 3017  03/20/20 19:42:51 +0000 sudo lvcreate --help
 3018  03/20/20 19:43:23 +0000 salt 'afs*syslog-[5678]*' cmd.run 'lvcreate -L 500G -n lv_syslog vg_syslog'
 3019  03/20/20 19:43:32 +0000 salt 'afs*syslog-[5678]*' cmd.run 'lvcreate -L 499G -n lv_syslog vg_syslog'
salt 'afs*syslog-[5678]*' cmd.run 'mkfs -t xfs -f  /dev/vg_syslog/lv_syslog'


## TCPDUMP on LCP Nodes
```
timeout 180 tcpdump -nn src 10.19.161.16 or 10.19.161.17 or 10.19.161.18 > temp.txt
timeout 180 tcpdump -nn host 18.252.146.202 or host 18.252.212.137 or host 18.252.129.160 > temp.txt
```


## Splunk on POP Nodes
5/27/2020


The POP nodes have Splunk UF on them that should have outputs.conf that point to Moose external LB. 

```
salt -C '* not *.local' cmd.run 'ls -larth /opt/splunkforwarder'
```

moose-indexers.mdr.defpoint.com ( DNS )  -> moose-indexers-e2df225b105dd4b6 ( AWS ELB ) Port 9998 -> moose-targets ( Target-group with correct indexers)

### NGA

Currently, NGA is pointing at moose-splunk-indexer-1.msoc.defpoint.local:9998, moose-splunk-indexer-2.msoc.defpoint.local:9998, moose-splunk-indexer-3.msoc.defpoint.local:9998 good luck with that!

```
salt -C 'nga* not *.local' cmd.run 'cat /opt/splunkforwarder/etc/apps/moose_outputs/local/outputs.conf'
salt -C 'nga* not *.local' network.connect moose-indexers.mdr.defpoint.com 443
```

### AFS


