Creating or Editing a Node

Scenario

This topic describes how to create and edit a data collection node.

The recommended installation path is /opt/cloud. This section also uses this path as an example. You can use other installation paths. Make sure change the path when you refer to the example here. For example, if the installation path is /tmp, change the installation path in this section to /tmp.

Preparations

• Creating an IAM user with the minimum permission
  IAM is used for data collection authorization. You need to create an IAM user with the minimum permission to access SecMaster APIs and disable verification rules such as MFA for the user.

  1. Create a user group and assign permissions.

     Create a user group on the IAM console, and attach a custom policy to the group.

     {
         "Version": "1.1",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Action": [
                     "secmaster:node:create",
                     "secmaster:node:monitor",
                     "secmaster:node:update",
                     "secmaster:node:taskQueueDetail"
                     "secmaster:node:updateTaskNodeStatus"
                 ]
             }
         ]
     }

  2. Create a user and add the user to the user group.

     Create a user with Access Type set to Programmatic access on the IAM console and add the user to the group created in 1.

  3. Log in to the console as the IAM user created in 1.
  4. On the management console, hover over the username in the upper right corner, and choose Security Settings from the drop-down list.
  5. On the Security Settings page, click the Critical Operations tab and ensure that the Virtual MFA Device is not bound.

     If it has been bound, unbind it. For details, see .

• Checking the disk space

  Check the disk space in the /opt directory of the ECS where you will install the component controller and make sure the space is not smaller than 100 GB.

  1. Remotely log in to the ECS where you want to install the component controller.
     • You can log in to the ECS management console and click Remote Login in the ECS list.
     • If your server has an EIP bound, you can also use a remote management tool, such as Xftp, SecureFX, WinSCP, PuTTY, or Xshell, to log in to the server and install the component controller on the server as user root.
  2. Run the df -h command to check whether more than 100 GB space is reserved in the /opt directory of the disk. At least 2 vCPUs and 4 GB of memory are required.
     Figure 1 Checking disks
     

     If the memory is insufficient, stop some applications with high memory usage or expand the memory capacity before the installation.

     To ensure that the /opt directory has more than 100 GB free disk space allocated, you can use the disk partitioning script to allocate the disk. For details, see Partitioning a Disk.

Creating a Node

1. Check operations in Preparations and log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 2 Workspace management page
   

4. In the navigation pane on the left, choose Settings > Components.
   Figure 3 Node management page
   

5. On the Nodes tab, click Create. The Create Node page is displayed on the right.
6. On the Create Node page, configure a channel.
   Figure 4 Creating a Node
   
   1. In the Network Channel Settings area, select the VPC and subnet the target ECS belongs to.
   2. In the network channel list, click Config in the Operation column of each channel. In the displayed confirmation dialog box, click OK.

7. Click Next in the lower right corner of the page to go to the Script Installation Verification page.
8. Select the ECS OS, follow the step, and click to copy the command for installing the component controller.
9. Install the component controller.
   1. Remotely log in to the ECS where you want to install the component controller.
      • You can log in to the ECS management console and click Remote Login in the ECS list.
      • If your server has an EIP bound, you can also use a remote management tool, such as Xftp, SecureFX, WinSCP, PuTTY, or Xshell, to log in to the server and install the component controller on the server as user root.
   2. Run the cd /opt/cloud command to go to the installation directory.
   3. Run the command copied in 8 as user root to install the controller on the ECS.
   4. Enter the IAM username and password created in Preparations as prompted.
   5. If install isap-agent successfully is displayed, the component controller is installed.
      Figure 5 Installed
      

   If the installation fails, rectify the fault by referring to Component Controller Installation Failure.

10. Check that the installation is complete and click Confirm in the lower right corner of the page.

    You can view new nodes on the Nodes tab.

Editing a Node

After a node is added, you can only modify the supplementary information about the node.

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 6 Workspace management page
   

4. In the navigation pane on the left, choose Settings > Components.
   Figure 7 Node management page
   

5. On the Nodes tab, locate the row that contains the target node and click Edit in the Operation column.
6. On the Edit Node panel, edit the node information.

   Table 1 Parameters of node information

   Parameter	Description
   Data Center	User-defined data center name
   Network Plane	Select the network plane of the node.
   Tag	Set the tag for the node.
   Description	Description of a user-defined node.
   Maintained By	Select a node owner.

7. Click Confirm.