Sensei on OPNsense - Application based filtering

[faisalreza]

hi, new user here,
been searching this thread but cannot find it yet

how to change db engine from mongodb to elasticsearch?
now already installed elasticsearch5 via the shell
does we have to reset sensei to default config or uninstall then install it back?

thanks for the clue

Regards
Reza

[mb]

Hi faisal,

Many thanks for trying Sensei.

Backend Database selection is done automatically based on your hardware resources. If you have less than 8GB RAM, sensei will pick mongodb.

[faisalreza]

hi mb thanks for answering
i have xeon e3 4 core 8 thread with 16gb ram

but no options for using elasticsearch, any required steps or i missed something?

regards
Reza

[mb]

Hi faisal,

Than it must be the cpu score. There is a 300.000 minimum cpu score requirement for Elasticsearch.

Here's  a quick hack:

1. Remove /usr/local/sensei/etc/.configdone

Code: [Select]

rm /usr/local/sensei/etc/.configdone
3. Edit /usr/local/opnsense/scripts/OPNsense/Sensei/check_hardware.sh file and locate these lines:

Code: [Select]

if [ $CPU_SCORE -le 300000 ]; then
       CPU_PROPER="false"
else
       CPU_PROPER="true"
fi

Change 300000 to a lower value, like 200000. 

4. Do a browser refresh on the OPNsense UI, and click on any sensei menu. It'll re-run the config wizard. Now it should select Elasticsearch.

Now I'm thinking: for cpu scores between 200K and 300K and if there is enough memory (>=8GB) I think we should let the user decide on the database backend.

[faisalreza]

hi mb, done that and here's the result

/usr/local/opnsense/scripts/OPNsense/Sensei/check_hardware.sh

Code: [Select]

{
   "memory": {
       "size": 17179869184,
       "proper": true
   },
   "cpu": {
       "model": "Intel(R) Xeon(R) CPU E3-1245 v3 @ 3.40GHz",
       "proper": true,
       "score": 224783
   },
   "opnsense_version": "1979_1"
}
is there any possibility to separate log file location for the reporting?, i have opnsense installed on a 128GB ssd and sensei looks like take amount of space for keeping log, does 500gb - 1tb disk good enough for log and analytics?

[mb]

Hi faisal,

Good, you can now do the initial configuration, it should install Elasctic now.

Currently database location is /var/db. Upcoming 1.4 or 1.5 will move it to /usr/local since /var can be a temp memory file system in OPNsense.

For disk sizing, you can use this guide:

https://help.sunnyvalley.io/hc/en-us/articles/360025047373-Hardware-Requirements