Daily Tech News show is made possible by its listeners. Thanks to all of you, including Scott Hepburn, Bjorn Andre, and Jeff Wilkes. Coming up on DTNS, the U.S. CHIPS Act restricts what companies can do in China. Samsung and iFixit launched their repair program, and the Open Risk 5 chip instruction set might be bad news for ARM. John C. Dvorak is here to tell us why. This is the Daily Tech News for Tuesday on No Agenda Show and D.H. Unplugged. Mr. John C. Dvorak, welcome back. Hello. Good to see you, Tom. You look good. Oh, thanks. You too. You know, your background there. You got a lot of junk. You maybe should clean out the place. You know, people keep telling me that, but I like it. You know, I can spot you have the Oxford English Dictionary Compact Edition, which comes with a magnifying glass. And I need that at my advanced age. Well. If we need it though, I could pull it out at any time. Let's start with a few tech things you should know. Uber turned a corner at seemingly just the right time, reporting positive free cash flow last quarter. That means it can fund itself and not worry about running out of cash. Free cash flow rates into account operating and capital expenses, but not non-cash things like share-based compensation and changes in the value of Uber's investments. They have some investments in Zomato, Aurora, Grace, et cetera. Once you take all that into account, given the state of the stock market, Uber lost $1.33 a share, but it's gross bookings, the actual business that it conducts on its platform like rides and subscriptions and deliveries. That all rose 33% on the year. So the actual business itself isn't doing bad. That was led by ride-hailing, which rose 120% on the year, while food delivery slowed to 7% growth, though food delivery still brings in the most money for Uber. Logitech announced a partnership with Tencent Games to launch a dedicated cloud gaming handheld later this year. The device will support Xbox cloud gaming and NVIDIA's GeForce Now game streaming service. No word on price or specific release date. Wi-Fi 7, which you can put in your brain as 802.11 BE, could start showing up in laptops within two years. Intel's Vice President of Wireless Solutions Eric McLaughlin told a conference in Asia, quote, we are currently developing Intel's Wi-Fi 802.11 BE in order to obtain the Wi-Fi Alliance certification, and it will be installed in PC products such as laptops by 2024. We expect it to appear in major markets in 2025. If you're wondering, Wi-Fi 7 is going to double your bandwidth, double your speed over Wi-Fi 6, and promises to improve stability in the 6 gigahertz spectrum. Insta360 announced a new 4K webcam with a three-axis gimbal, the Insta360 Link. It uses a half inch sensor and physically pans and zooms the camera to keep a user's face in frame. Also supports gesture control for zooming, offers a desk view mode to point the camera down for overhead content, and it can go into portrait mode for vertical video, and you can get it for 300 bucks. Finally, Xiaomi announced the Mijia glasses camera, a pair of smart glasses with a single Google Glass-style micro OLED display on the right eye, and two cameras, a 50 megapixel main shooter, and an 8 megapixel periscope zoom. Xiaomi says the display can be used for real-time translation and AR effects, something Google Glass doesn't do. Other features will be added in future updates. The Mijia glasses use a Qualcomm Snap Dragon chipset with 3 gigabytes of RAM pre-orders, start August 3rd for $2,499 yuan, that's about $370 US. All right, John, let's talk about Samsung's Repair Program. Have you heard much about this? Yeah, something that, I mean, ever since the days of Wordstar when licensing came around, all these companies think that they own their products even when you have them because you're just licensing the product when, in fact, you bought it and you should be able to fix it and that you have to have legislation so you can now fix it. This is not part of that fix-it legislation. Yeah, this is a response to that. Samsung announced this program back in March. It's fairly limited. If you own a Galaxy S20 and S21, a Tab S7 Plus, you can buy official Samsung replacement parts and access guides on how to do certain types of repairs. So your phone may not be on that list, for instance, the S22. I'm sure it's not. Samsung plans to add more parts and support more repairs going forward. No word on when or if that will happen. One of the things you can't do is just replace the battery. You have to replace the entire display if you want to get a battery. But for now, what you will get are parts, tools and guides to fix your screen. Like I just said, back glass and your charging port. Well, the screen is the big deal because people break the screen. The next thing you know, they had to buy a whole new phone. The battery thing, I mean, the phone makers could have, the early, I have a Galaxy, an old one. Well, like the original, I think the one and the back comes right off. It snaps right off and put the battery, put new battery in. But they seal those batteries in. There is another way of getting people to buy more cameras. Yeah, I'm buying more phones. Cameras is what they use them for. It gives you, it gives it's easier from to do watertight and dust tight. And it's easier for them to make you buy a new phone. So yeah, I guess if you do drop in the toilet, like people do. If you want to get any of these parts, you can get them through iFixit or you can go to Samsung service locations, retail locations. Samsung is also providing a return label. If you do the display replacements, you can send back your old display for recycling. And as I mentioned, that display assembly does include a battery. So even if your display is fine, if you're really in a pinch, you could plop down for a whole display assembly and at least get a new battery. Samsung says the prices are the same that repair shops pay. So for example, for an S20 display assembly is 200 bucks, back glass is 70 bucks, charging port is 60 bucks. And this isn't iFixit's first partnership. In fact, they have partnered with Google and Valve on repair programs as well. And Apple has its own. They haven't partnered with anybody because they're Apple, but they have their own DIY repair program where you can order parts for them. It is becoming the norm, though, for these big companies to at least do this much. I congratulate them. Yes, that themselves on the back. Roger, I know you're interested in this, particularly for your own phones. I think it's a good sign that, you know, I don't see this as being a big thing for the larger consumer population. But it is a good sign to recognize that there are people, or at least customers, who do want to go through the hassle of fixing it themselves. And it's at least a nod that it is something important.  This is probably something that's probably going to be attempted probably by less than 10% of users. But, you know, it's still a good step. Ideally, I would like a device that's consciously designed in a way that allows it to be separated into pieces and put back together with the minimum amount of lute swearing as you jab your thumb with the jeweler screwdriver again. But no, it's a good step. You know, it's best for is iFixit. iFixit doesn't lose it all here. They get direct supply of parts. They can also still sell third-party parts. So you can actually repair more things on a Samsung phone through iFixit than you can through this official repair program because iFixit's also like, well, if you want to repair a battery, we can sell you some of those. They don't have it for the S22 yet, not sure why. But there's other ways of doing it with iFixit. And then they get to offer this like, well, if you really want like certified parts from the manufacturer, you can get that through us now too. And let no one under be any disillusion. This isn't a product of some sort of forward, you know, egalitarian thinking. It's probably like, hey, we want to stave off potential, even more potential legislation that really puts us under the microscope. No, it was altruistic, Roger. The looming threat of legislation had, I'm sure, had zero. That'll be the day. Speaking of legislation, let's talk about U.S. President Biden expecting to sign the Chips and Science Act of 2022. May have signed it by the time you listen to this. We covered the details of the act itself on Friday. The short version, if you missed that, is it's going to authorize the United States government to spend $280 billion on research and development over the next five years. $39 billion of that is going to go directly to subsidize semiconductor manufacturing. $11 billion goes to chip plants research and workforce training and another $2 billion for making older chips used in automotive and military applications. It's not a ton of money going to semiconductor manufacturing in the grand scheme of things, but the chip companies are excited by it nonetheless. TSMC is committed to spend $12 billion on plants in Arizona. Samsung said it's going to spend $17 billion in Texas. SK Hynix announced $15 billion coming to the U.S. in investment, although they haven't given any plans on where. Intel and Micron to U.S. companies also planning to take advantage of the subsidies, but there are strings attached. Both Bloomberg and Nikkei Asia noticed a clause in the final version that passed the House that says that a company that accepts a subsidy agrees not to make a significant transaction that would materially expand its semiconductor manufacturing capacity in the People's Republic of China called out specifically or any other foreign country of concern for the next 10 years. China is already on that list of countries of concern alongside Russia, North Korea and Iran. Companies would be allowed an exception to protect existing business interests or expansions that serve that country of concerns market for legacy semiconductors. So if you're making and that's defined as 28 nanometer process semiconductors or older, you can spend some money expanding your plant there, especially if you're making chips for the Chinese market, but not anything newer. Most of these companies don't make anything newer in China. TSMC makes a 16 nanometer process in Nanjing, but most of the potential subsidy recipients wouldn't be affected. So John, there's a race on China says it aims to source 70% of its chips from its own domestic companies by 2025. Bloomberg estimates the China's premier chip company, SMC, though, is about six years behind TSMC and advanced chip making equipment from companies like ASML and the Netherlands are being restricted by US export rules. So it might be tough for China to catch up.  I don't know how tough it's going to be. We've caught up to everything else. This, by the way, I think the word that you read in there about the money going to China, I think they dropped in the word significant. And I think, is that defined in the bill? I don't think so. I agree not to make a significant transaction. Yeah. It's significant for the semiconductor industry is in the billions. I mean, it's significant would be half the bill. I don't know what they're trying to do here, but a lot of the R&D money. I don't know. A lot of that's going to green stuff. And I just don't feel sorry for the semiconductor industry. I mean, Intel generally just itself, and it's not even the first, second, third, fourth, things like the fifth or sixth biggest chip company now with TSMC being number one and surprisingly in video being number two. They do usually about $80 billion a year. I think they've dropped off quite a bit because it's of the pandemic or something happened. And this is a lot of money that they're just plowing through. And now they're whining about the fact that they've outsourced all their stuff overseas to these fabs that are just doing a better job in terms of what it costs to make a chip. Intel does have a fab. They're going to start there. What is Intel fab systems that IFS or IFB or something that I have the, and I think they're trying to get into the fab business. I think they're just looking for the government to give them a little extra money, free money is the way I see it. I'm not as jacked up about this chip's bill as everybody else is. I just don't see these guys needing that much help from the government. They can do it themselves. They know how to do it. They're some of the smartest guys in the world. I did a quick search on the bill. The significant transaction is defined in your agreement with the secretary. When you sign your agreement to get the subsidy, that's when they agree on what a significant transaction is. It could be different for different companies. I know Intel, the CEO of Intel is out yacking about how they're going to move their facilities or their manufacturing to Europe. It just seems to me that what is Europe, which is, I don't see why we moved any of our fabs out of the United States because this is all protected stuff. It's dangerous for the national security for these chips to get out and show up in Russian airplanes, for example. This whole thing, this loss of the industry in the United States has always baffled me. It happened pretty much overnight. It started happening, but it snuck up on you. Next thing you know, I think we'd make 15% of our chips in this country, maybe. The argument has always been cost. That's the argument they want to use to get the subsidy, which, honestly, again, this is not that much money. It's almost like bragging rights to get this money. Free money. Yeah, and who doesn't like free money, right? So any free money is better than not getting any money at all. But it's enough to get the plant made. It's basically using the United States government as an investment arm. Sink a little seed money into us building a new plant. Yeah, generally what the Chinese do. So the cost thing is I've always thought it was something somewhat mythical. Because I think it's less cost and more tax benefits, tax breaks, special deals. I mean, the first time I went to China, mainland was in the 90s early. And I visited the Samsung keyboard plant. And Samsung had a keyboard plant there. It was either Samsung or maybe an Acer. Whatever the case, one of the two, they had a keyboard plant there. And I was talking about the reason you guys are paying, at the time they were paying their workers $25 a week. And I said, so the whole reason for being here is because you're saving so much money on labor. And he says, you know, maybe, but the real, we want to move to, we want to get rid of all these people and put in robots. We want to robotize everything. And then we'll be, you know, then we can make some money. And it always seemed to me that the labor thing is kind of a stopgap, the cheap labor in China, which isn't as cheap as it used to be. And the whole thing's going to be robots. Well, we can do robots here. So there's got to be some other element here. And it's got to either be the cost of land, the tax benefits or some other thing. The incentive to build. There's some incentive missing that we don't have in this country. I know in California, what it is, it's the ridiculous personal income tax and taxes on business. Yeah, I think what would be best for everyone is if we had a nice distributed system, where if something goes down in one place, it doesn't bring down the whole system again. You know, like a good distributed architecture. Yeah. One of these days. Well, we could, we can try to come up with solution next week on DTNS experiment week. We're swapping out our normal DTNS shows, trying out some new ideas. We did this last year and now you can enjoy shows like barbecue and tech and the tech, John. So who knows what's going to come out of this. This year we've got Rob Dunwood and Rod Simmons giving us a reaction show. Instant reaction to Samsung's announcement. Nicole Lee is doing a show on tech culture from an Asian American perspective. That all starts next week, Monday, August 8th, on the DTNS feed right here where you're getting this show. Risk 5 is an open standard instruction set architecture based on the old reduced instruction set architecture risk. It dates back to about 1980. Risk 5 was introduced in 2010. It's kind of like ARM, except you don't have to pay anybody to use it. Earlier this month, the first laptop running on Risk 5, the Roma, went up for pre-order. That'll be shipping in September, they say. Pine 64, a maker and seller of hacker-friendly single board computers, just introduced a Risk 5 powered single board computer called the Star 64. And John, you've been following Risk 5. What do you think it offers over, say, an ARM or an X86? Well, for one thing, I had a chat with David Patterson, who's a retired... He's the guy with Hanna C. Designed Risk to begin with, and his fingers are all over this thing. And it's really been redone a lot. It's nothing like the original Risk, and I'm not sure how much... It's re-architected. And it's got some elements that are quite interesting in so far as it's free, it's open source. And it was described to me, the best way to describe it was... Because I'm trying to describe it as something that's modulated, take apart, because you could put another instruction set on top of the basic architecture and actually make it an X86 chip. But it's described as a standard in line with Ethernet, look at it as Ethernet, that's your best bet, or the IEEE floating point standard. That's how they're handling this. So it's going to be a standardized product that anyone can build and it's open source and so you can do the modifications, do whatever you want to it, in the same way you can with ARM. And so ARM costs money. You buy the IP from ARM and then you have to pay a royalty. You have to do the same, and you can't even do that with Intel. They just keep it for themselves and you have to re-engineer it from scratch if you want to do anything with the next X86 instruction set like AMD did and surpassed Intel in some ways. So the idea is that this thing is just... It's true open source and standard. It's a standardized product that will be available to anybody to use as they wish. And there's already being used a lot, I understand, by some of the chip companies like I'm guessing Nvidia has got risk chips built in here and there and other people are looking at this as a way of saving money. This is a winner except that they're making some missteps in so far as their marketing is concerned because I was watching a recent discussion about from one of the guys that is part of the team at the risk5.org or whatever the main site is they have. You can go there. You've got some videos. You can learn quite a bit. But there's talking about, well, we're going to do a laptop because developers love laptops and so we're going to do a laptop and we're going to be able to take the chip out and put another more, a faster one in. You can do chip replacement and this is something I've been hearing about since the 80s where, oh yeah, you can upgrade. I think even IBM tried to do this once is you can upgrade the processor and anyone who's watched this fiasco go on and on is just that when people upgrade the processor, if you could say you can, it's not the problem. The real upgrade you need is changing to USB-C, changing to a better display, changing to a different HD, an HDMI, something with a different kind of... Something more like what the framework laptop is trying to do, whether we're allowing you to swap everything out. Yeah. Well, it turns out to cost more. It seems just to toss the machine. Just go, but you know, I don't know, I just bought a Lenovo from my wife which she wanted a touchscreen. So I just, I don't know what, I didn't pay anything for it. And then to me, I've been buying these little, I don't have one here, I should. You know the Intel NUC, which is a new unit of computing. Well, they're actually, you know, Beelink and ASPC and all these other guys are building these things. And they're, I just, this Beelink S, I just bought one from Amazon. There were $165 with a 10 nanometers Celeron in it to, I think, to a four cores. And with a 20% 20, no $20 off coupon that comes with it. So for 150 bucks and it's got two HDMI for two monitors. This thing is loaded. It's got built-in Wi-Fi. It's got a decent solid state hard drive. I don't see why I'd be swapping anything.  But getting back to risk five, do you think that this is at Raspberry Pi level yet? God knows at Raspberry Pi level. Yeah. Well, it's good for hotness.  Yeah. They ran it against the Raspberry Pi running the same software. And it turns out to be about 20%, 20% slower. Okay. But, you know, with the, with the brain power behind this thing and now Intel's dropping a billion dollars into the project. And I don't know if they're doing it as a defensive investment or they're doing it to get on board. Don't know. But if they bring some of their technology, process technology into the fray, they can get Raspberry Pi will be left in the dust. But right now it's, I'd say, almost on par. Yeah. It feels a little like arm did way back, which is, nah, I don't know if this will ever be in a PC. And of course, now we look at arm instruction sets at the MacBook Pro and people are saying it's one of the best laptops out there because of the chip and the chip design. So it certainly could have the potential for that. It sounds to me, if I had to guess that Intel's throwing money at this in the hopes of leapfrogging arm, which is to say, arm is not going to throw money in this because it's a competitor. So if Intel can make risk five work better, Intel can not only put a competitor on arm but also take advantage of it because they're working directly with it. Yeah. And Intel needs something like this. So it's like IBM getting involved with Linux. I think it's probably a good idea if they play it right. The problem is Intel has this huge problem with not invented here at the corporate level. And so they will have people trying to submarine the efforts, I believe, because Intel's always had this problem with taking in other technologies. And it's a corporate culture problem. It doesn't matter who's in charge. Yeah, which means you can't fix it. It's tough to fix it. So we'll see where that goes. But I do think that, and I looked at the timeline of Ethernet, which I believe was invented around 1973 and came into the play around 72, took about 10 years, took actually about 12 years before Ethernet 10, probably it was the one or two megabit per second Ethernet before it started becoming part of the public domain and public consciousness. And then you didn't get to, I forgot the year that 100 megabit and that gigabit and I got 10 gigabits, got 40 gigabit Ethernet. It started jumping when it jumped to gigabit. And so it took that long. This project, this risk five began in 2010 at Berkeley. It's a Cal project. And so now it's 12 years old. So it is getting to the point where it's like Ethernet, one megabit per second Ethernet. And so now the timeline follows through within two or three years, I'd say within, it's 22, by 2025 I think this will be a player. It's a Swiss company now. It's a nonprofit that is overseeing it. So it's the perfect positioning to be a standards organization. They're kind of cagey about the license. The only licenses I could find were Creative Commons licenses, but I didn't dig down far enough. So I'm curious if... Well, my understanding is it's open source period. Yeah, I think everything is certainly open source and it may just be a Creative Commons license on the source code. I think that I don't know the license either, but I would say the license, I'm guessing the license is one of those. You can use it, but you, whatever you develop, you have to put back into the pot. Yeah, it's perfectly positioned to be a standard. It's certainly something to keep an eye on. So good thing... Talk about it again in three years when you have me back on. Yeah, yeah, please make it back before three years from now. To make you feel welcome, I put a Winamp story in the show today, you know? Oh, yeah, it's great. Just something comfortable. Winamp. Winamp's back four years in development. The popular media player software is back out of beta. You may think, well, wait, Winamp ceased development in 2013, but if you think back in 2018, there was a leak of a new version of Winamp, Winamp 5.8, and they went ahead and published it because of the leak at winamp.com. Well now, Winamp 5.9. The next version is official. The code base was updated from Visual Studio 2008 to Visual Studio 2019. That sadly means that no longer will work on your XP or Vista machines, but it'll work on Windows 7up. Work can now begin because of that code base switch. That's what took them four years to add things you want from it. So native support for more file formats. They're talking about VP9, HLS, H.265, stuff like that. Support for new online services, which is, I think, something that a lot of people would want out of this. You know, Winamp stories may be a little similar to Risk 5, something with its roots in the past, but positioned to be a little more open and accepting as an alternative in the future. Yeah, well, that's hope not. I'd hate to equate the two to be honest about it. Winamp's like an old one. Do you have fun feelings for Winamp? It's like an old Model T, you know, that just worked in this day. Yeah. And it's just chugs along. And so instead of like just dropping it like you should have, bringing it back is kind of a Model T hot rod. Okay. Well, it probably, it'll be, I'll try it. Yeah, I will do, of course. Let's check the mailbag real quick. We had our Photo News Monthly episode this weekend, hosted by Amos and Rich Drophilino. And Yaniv, a photographer with a Nikon ZFC and manual lenses wrote in and said, a few years ago, I had the Sony A6000, great little camera, but I wanted to take time lapses with it. There was no way to do it easily, but I found out that someone hacked the software and with a new software installed in the SD card, you can override the latest version and be able to create amazing time lapses with a few clicks. I think companies create a version of the camera's software and sometimes don't realize what people want or what they can do with it. Important details like incomplete software is a problem and shouldn't be released until they're complete, but I am all in on new capabilities created by software updates. Agreed, Yaniv. You know, time lapse is a great little item to have on your camera. Very few cameras have it. And the last camera I had that had it was an old Kodak 3 megapixel clunker. It was a big thing and it had time lapse on it and you could put it on the outside and it also had variable time lapse. So you could do one frame a second, you could do one frame a minute, one frame an hour, one frame a day. I believe that had all those variables, but it had variables. And it was a great idea, but I don't know why these guys can't just won't just do that. And now in those Sony cameras, which are stunning kind of pro grade cameras, these things are used by movie makers. It's a good idea to put it on there just to draw attention, but of course it has to be done by a hacker. Yeah. As so many good things are, John Dvorak, a pleasure to have you back on DTNS. I know you're up to no agenda show. Tell folks about that and what else you got going on? Well, the no agenda show with Adam Curry and myself is a three hour twice a week show. No agenda show.com. If you want to listen to an episode, we deconstruct news stories, basically, we take a look at a news story and then we take it apart and see what PR agency was behind it. If it's a really a native ad, we're seeing a lot of those on NPR now.  And it always runs exactly one minute or exactly two minutes is right on the money for a native ad. And it's about Mexican tacos at Taco Bell, something like that was one of the more recent ones. There's a couple more that come out. Apple's got a new native ad that's floating around the country. Somebody sent it to me the other day, but we look into those, but we look mostly in the news stories and we try to get to the bottom of the various bills in Congress and the repetitive news stories you see here and there. And then the other show I do, is DHM Plug, which is a stock market analysis show. I've always written about the financial business. And so I'm not writing about it anymore. I'm doing the show with Andrew Horowitz, who's in Florida. And we talk about it's a one hour show to the money. It's like an hour. It's not like no agenda show is open-ended so it can go on for days. We once did a seven and a half hour show. But DHM Plug, if you're an investor, I think you'd get a lot out of that show. Excellent. Go check them out, folks, knowandgendershow.net and dhamplug.com. Big thanks to brand new boss Paul just joined us. Started back in a song. Patreon, thank you, Paul. If you go back us at patreon.com. We might be thanking you tomorrow. Patrons, stick around. You get an extra show, Good Day Internet, coming up right after this one. You can also catch the show live Monday through Friday 4 p.m. Eastern 200 UTC. Find out more at dailytechnewshow.com slash live. We're back tomorrow with Scott Johnson. Talk to you then. This show is part of the Frog Pants Network. Get more at frogpants.com.


Infomation is power Through information sharing, we work together as East Africa Combating Transnation Organized Crimes It is very difficult for one country to be able to work independently to combat crime Interpol is implementing the Interpol East African Community Project in the six East African countries Burundi, Kenya, Rwanda, South Sudan, Tanzania and Uganda Crime is now not within a border but beyond a border and what affects you affects your neighbour Therefore the police has to work also transnationally to be able to address and deter these criminal activities In the region we have film and trafficking, drug trafficking, trafficking in wildlife trophies, theft of motor vehicles, trafficking in illicit weapons Proceeds of these crimes fund other crimes including terrorism Terrorism has been in this region for a while now Alshabab, ally democratic forces and the Lord's Resistance Army among others have continued to unleash terror and insecurity in the East African region Considering that the criminals work hand in hand so should we so that we have a concerted effort that can equally or even better manage and address these criminal activities The evolution of this operation of criminals changes day by day so that the officers of the police and the police in general need to be able to evolve The Interpol East African Community Project has invested in modernizing the National Central Bureau which are very central to Interpol operations ensuring that there is coordination of Interpol activities among the six countries The modernization comes in form of a computer fixing or installing a state of the art of the modern rotas for communication We believe that this IESC modernization component has made our National Central Bureau to be more productive to provide a conducive working environment for the officers that sit within these NCVs Interpol also is doing a lot in the areas of training capacity building Training we are receiving through Interpol is helping the member states to improve their work and performance in handling the crimes in general All countries have their individual jurisdictions and criminals understand this very well but through Interpol we are able to link you that's why we have a system which is known as I247 I247 is an Interpol system of secure communication that is available to all Interpol member countries and they are able to share information with each other Frontline officials have access to over 124 million records but it means that they are able to stop any unwanted individuals from coming into the country to cause problems within the region Ultimately we believe that with the presence of the I247 communication system we'll increase information sharing we'll enhance regional collaboration and at the end of the day enhance border security within our region As we know criminals work together criminals communicate so I247 enables different police agencies also work together make sure that people's life and their property are secure are protected so we are ready, we are well equipped we have the system, we have the equipment to handle any transnational criminal or national criminal who is participating in these crimes Interpol through the project does a lot to enhance enforcement in the region to work together we are happy with this project because it has enabled enforcement to really fight terrorism and other forms of crime For East Africa I'm seeing a bright future I'm quite optimistic that this region will at the end of the day emerge victorious from the threats that are posed by terrorism and other organized crime as table more secure East African community


Well Roy, isn't it just about time that we kind of banked the embers on the campfire and got ready for your yarn about the old frontier days? Yes, I reckon it is, Bern. And I think that tonight we've got a story that is just a little bit different. Oh really, Roy? What's the story about? Well Pat, although not many people today know it, but during the early days of the West it wasn't at all unusual to walk up to a ranch hand or a miner and ask him for a match and hear him say... A match, of course, my friend. I'm only too glad to oblige. You mean there were Russian cowboys in the West, Roy? I sure do, Pat. And although there weren't a lot of them, they contributed at least their share in the building of our frontier country. Oh then tell me, did you ever know any of these Russian cowboys? Well now, wait a minute. Look here, Pat, as long as I'm going to appear in the story, why not let Vern Smith get started telling the folks how this particular story came to take place? In the early days of the English feudal system, the ruthlessness of the barons caused Robin Hood to form his band of Avengers, who robbed the rich to help the poor. And so, in the early days of the West, the growing injustices brought about by the ruthlessness of the cattle barons gave rise to more than a dozen frontier Robin Hoods, outlaws to the very rich, called friend by the poor very poor. One of the most colorful of these was a broad-shouldered, blonde giant of a man, whose name, virtually forgotten, was Boris Bradnevich. But in the rich valleys near the Blackhawk River, he still remembered as the Russian kid. It was in the spring of 83 that a sudden wave of brutal lawlessness engulfed the entire Blackhawk Valley. Cattle were stolen, ranch houses burned, men wantonly shot down. Towards sunset, one April afternoon, two men were seen to occupy a table near the rear of a crowded local cafe. Now, I look, Fink. I guess I know what I saw.  Why, the Russian kid would no more come to this town after what's been happening lately than to go out and shoot himself. Yeah, well, I think that's why he's coming to town. I think he's got wise that we've been pulling these raids and blaming it on him. Yeah, let me tell you something, Jingo. If the Russian kid does show his face around here, I'll personally... He looks like a man who might help me. Yeah? What do you think I can do to help you? I'm looking for a man they call Fink. You know him, maybe? Yeah, maybe I do. What's it to you?  Well, are you sneaking low, darling? That my friend would be a big mistake on for your gun.  Maybe you get the boss covered, but you haven't got me... What is going on here? Who shot that gun out of this polecat's hand? I did, mister. And since I'm right behind you, you'd better drop that pop gun of yours and quick. Well, that's better. Thanks, brother.  I wasn't interested in saving your life. I'm interested in only one thing. One thing, eh? This is stick up. You want money? No, I came here looking for you. And now that I've got you, I'm taking you right along with me. Eh, what are you anyhow? Here, look at this. You can see for yourself. What the blaze? A private detective for the New Mexico Cattlemen's Association. What are you doing here? You've got no authority on this state. That's where you're wrong. I've got six laws on my side and each one of them is covered with lead.  Yeah? Well, we've got our own laws down here. Sorry, mister. I'm taking the Russian kid with me. Come on. What's the idea, Boris? You might maybe if we stop near these boulders so I can light my cigarette. No, but don't waste any time. Eh, I just take a match and strike it. Here we are, Boris. Hold it there, mister. I've got to come. Hey, wait a minute. Get this gun. All right, friend. Just drop it. Come on. There you are. But still, I can't figure just what happened. These are your men? Yes. They're the famous band of the Russian kid. You do not think I ride in the town without making preparations for all kinds of trouble? Oh, no. Always they wait right here for me when I light a match, does the signal. Oh, I'll be jiggered. Road myself right into a trap. Oh, you must not feel so bad.  Only thing is, Russian kid smarter from you. Well, what's the next move and who's making it? Next move, I'm sorry to say I make.  Well, that's just great. Oh, do not be distressed, my friend. We give you a very, very beautiful grave. Right by this chair and table. I suppose there's no use in my saying anything. Well, what could you say?  You say something that makes me feel sorry then all day after your funeral I feel very, very bad. No, no, it is best you only tell me just how you like to go. Okay. What's the choice? Well, first there is the knife. Knife is maybe a little slow, but knife is quiet. Then I get rope, rifle, even maybe shoe should want it, I get here some poison. No, thanks. I'll take it the fast way. Use your gun. Oh, my friend, you're truly a man of great courage. More courage than I ever found in a man before. I tell you what I do for you. Yes?  Give me back my gun? What for? You see, clog on wall, in one minute that clogs strike eight o'clock. Yeah? Well, I put your gun and my gun here on the table between us all. And when the clogs start to strike the first stroke of eight we both go for our guns.  Is that all right from you? That's one offer I can't afford to refuse. Good, good, good.  That's why it is fun for us both maybe, eh? Ah, look. There's only a few seconds left now until the clogs start to strike. You are ready? I'm ready. For the sound of this striker we both go for guns. Now let us wait. Dappen, what did you do? Nothing much. I just beat you to the draw.  You can shoot no better than to shoot the gun out of my hand. I thought that was pretty good, shooting. You see, I aim for your hand. I do not aim for your hand. I aim straight for your heart. Well, maybe that was because you're afraid of me. I wasn't afraid of you. Oh no, I insist. You have shells left. You must shoot me. Sorry, I can't oblige, but instead why don't we just save our shooting for those that need it? Eh? What's that? Who do you mean need shooting? Well, maybe Fink and his cutthroats, but until we can prove it, let's just say the men who have been robbing this valley blind and putting a blame on you. Wait, you mean you do not believe I've been making all these raids around Black Hook? Not only that, but I know and I think you know who has been making them. But then why you arrest me for cattle stealing? Why you take me away from the cafe? Let's say it was to save your life. The Russian kid is as good as a whole posse of sheriffs in a valley like this where there's big ranchers who've beaten down the poor. You see, Boris, I'm not a cattle association detective after all. Oh, then who are you? I'm a special United States marshal sent down here to straighten things out. Then you arrest me anyhow. Far from it. I've sent the Los Alamos for some deputies. When they get here, I think we'll have the goods on Fink and his gang. But me, what about me? Well, we reckon to leave you here, Boris. We figure that if you're around, you'll see that justice is done. Well, the time has come again to say it's been very nice having you with us. And now that you know the way, why not drop in again? Yes, sir. We'll all be back again next Tuesday. So until next week, we'll all be looking for you. This is Roy Rogers saying goodbye, good luck in me there. Good Lord, take a liking to you. Don't forget smiles are made out of the sunshine and a frown from a rainy day. You'll be more than repaid if you remember that a smile goes along the way. Roy Rogers, Bob Nolan and the Sons of the Pioneers appeared through the courtesy of Republic Pictures. Now this is Vern Smith saying good night for Goodyear, the greatest name in rubber, and reminding you that more people ride on Goodyear tires than on any other kind. Tune in again next Tuesday at this same time when Goodyear will bring you another get-together with Bob Nolan and the Sons of the Pioneers, Miss Pat Friday, the Far Brothers, Perry Buttkins Orchestra, and starring the King of the Cowboys, Roy Rogers. This is the Mutual Broadcasting System.


Tom here from Lawrence Systems, log management. It is, well, not the most fun part of SysAdmin, trying to solve where to put all the logs, how to get them all from many locations into one location so you can consolidate them, parse them, go through them, and create some actionable intelligence from it. And those tasks, well, they can be daunting with all the logs that all the many disparate systems we have generate. And the solution I came across that I really like is an open source tool called Graylog. Now they do have an enterprise version and we'll talk about the differences, but I'll be using the open source version in this demo today and show you how to kind of get started with it, which is relatively easy. They've even made OVA files so you can just download a VM, they've got a Docker image, and there are instructions that I followed to set this up on a standalone Debian server. Well, they were pretty easy too. We're gonna talk about how to ingest some logs, how to configure a couple different servers and kind of the process flow and how Graylog works. This is in no way endorsed or sponsored by Graylog. I'm doing this completely of my own accord because well, I wanna share a really interesting tool that I use to solve my log manager problem with all of you. Before we dive into those details, let's first, if you'd like to learn more about me and my company, head over to laurancesystem.com. If you'd like to hire a short project, there's a hires button right at the top. If you'd like to help keep this channel sponsor free and thank you to everyone who already has, there is a join button here for YouTube and a Patreon page. Your support is greatly appreciated. If you're looking for deals or discounts on products and services we offer on this channel, check out the affiliate links down below. They're in the description of all of our videos, including a link to our shirt store. We have a wide variety of shirts that we sell and new designs come out, well, randomly. So check back frequently. And finally, our forums, forums.laurancesystems.com is where you can have a more in-depth discussion about this video and other tech topics you've seen on this channel. Now back to our content. All right, the first thing I wanna cover is open source versus enterprise. Yes, they do have an enterprise version. It comes with support and licensing. And we're gonna be doing all of this in the open source version, which does include quite a few things. And particularly ones that I was just asked about the other day was alerts and triggers. Do they work with the free version of Greylog? Yes, they do. I think that's an important distinction and that means you can not only ingest the logs, you can create some data on these and create a trigger point by which you want to send notices. Goes a little auscult, but we're gonna cover this video, this is really just getting started, but I wanted to mention that's available. Now, if you're doing only five gigs or less a day in logs, they do give you free the enterprise version as well, which has a few more features, which includes the offline archiving, which is pretty cool. And if you're working with a team of people, it's got user audit logging so you can figure out who looked at what log and sometimes for compliance, it's not just about logging, it's about logging where people went in your logging server. So they do have some advanced enterprise-level features that come with their enterprise version and I don't know how much it costs. I have no idea because like I said, we're gonna be doing this with the open source version. They also have an entire library of data sheets, case studies, webinars, tech talks, et cetera. And it will give you ideas, for example, of how the dashboard looks.  I wanted to do this video because it'll give an overview of how to get started and maybe something, even though I've went through a lot of this, I didn't really understand until I started really using Greylog was how to build the data sets and how to get the data in to Greylog. So this is, like I said, more of a getting started video, but they do have quite a bit of documentation. Now let's close these here and talk about actually installing Greylog. It's rather simple to install. Goes out of scope of this video.  They made it that easy.  They also have Ubuntu, Debian, CentOS, SUSE, ChefPuppet, Docker, Amazon Web Services, any fully manual setup. So if you are a fan of building it or pulling a Docker image and putting this together, pretty straightforward there for a quick start. I did this one right here, which was follow the Debian installation. Now, my production environment versus the test environment I'm gonna be showing today, which is right here for the test environment.  That is an extra step you can do to put something else to handle certificates in front of it. It says by default it just runs on port 9000. I chose to just leave it at this because this is a demo that's gonna get destroyed, but yes, that's why it says not secure for those wondering. There is another step in here about putting in something like Nginx or whatever reverse proxy of your choice in front of it if you'd like to. Probably because you want security on there. Now, let's actually talk about the process flow because this is the part that confused me a little bit and we're gonna go over to this little flow chart that I made. This was the missing piece at least in my head and maybe this will help you understand how they ingest data and gray log. They have a couple of different visuals in there about how things are parsed, but I wanted to break it down this way to kind of explain things because this is what was a little bit troublesome for me when I first got started. And we're gonna be doing all this with Syslog, but it doesn't matter what your external log data is, there's quite a few different formats that it supports. We're gonna be using Syslog for all of the demos today, but we'll cover some of the other ones that are supported in there. We take the Syslog data, we have to define an input in the system. So we take that defined input, we have the option to add an extractor. Now, extractor seemed kind of unusual, but it's a parser essentially and it's a parser that can use Grock, it can use Reg X and it takes the data then parses it into fields and basically organizes it into the Elastic database, but you don't need to have an extractor, you only need the extractor if you want things put into nice organized fields. So yes, while they're great to have, and by the way, you can have mixed content. You can have an extractor to extract some of the data, but some of the data can remain unparsed. So it kind of goes back and forth and the extractors get attached essentially to the input. And we're gonna walk through all this, I just wanted to kind of define a workflow. So we have an extractor, for example, on my PF Sense that extracts the filter logs of PF Sense into parsed data. Then we have no extractor on the Unify one that we have in here, and it just has a bunch of unformatted data. Now, the unformatted data versus formatted, yes, you can search any of the data, whether it's formatted or not, and you can write your own extractors and I will leave you the extractors that I have posted on my GitHub for my PF Sense. There is a trickiness and there's a few of them out there, the ones I will leave you with, you can just import from my GitHub and they work perfectly fine. We'll talk about how to put those in. Now, once you have that parsed and unparsed data, then it needs to go over to an index or it can go to a stream, that's why this is kind of an or. If you don't create a stream and it sounds like the stream should be part of just the way you stream data in, but it's not, a stream takes and you build rules around a stream and those rules land it in a different index. If there's no stream, everything gets to the default index, just everything lands there. That can be a little bit tricky with gray log because you've dumped everything in one single index. Each index has its own retention settings and parameters. So you can parse it still, even if everything's in one index, but the index, let's say you have a 30 day rotation, everything has to follow that index 30 day rotation. But if you have different retention for different servers, you really want them each in their own index, not just for the filtering, but so you can have retention that is relative based on how the stream parses out the data and lands it in the index. But I just wanted to cover this part real quick to kind of give an idea in an overview. It may seem confusing, but hopefully this will alleviate some of the confusion later on as we create these. And we're going to walk through the process of creating another input in addition to the two inputs that I have. So I can show you how all these inputs work. Now let's look at the inputs that are existing. We have one for PF Sense. PF Sense, you go to the logs, go to settings and my gray log server is at <IP_ADDRESS>. So 3.200 is the IP address. And then we have the syslog right here, port number. So it's 1514 is the one I chose. Let's go back over to the gray log server. We're going to system, we're going to inputs. Here's the PF Sense input, more actions, edit input, we called it PF Sense, bound it to this IP address, which is zero zero zero, which means bound it all IP addresses. We defined 1514 as the port. Now 514 is a default syslog port. I put a one in front of it to make it simple. You can use any port number you want, but remember to deal with firewall issues, such as do you have ports under 1024 allowed open by the gray log service? Depending on the permissions you have running, that could be something that hangs you up. So I'm choosing a higher than 1024 port number. And I know I have port 1514 open. This will kind of depend on the configuration of the server. Actually this particular server, I've got the firewall turned off because just makes my life easier for doing these demonstrations. Now, port 1514, allow overriding data. Allow to override data, current date, if not parse. Yes, store full message. Yes, give me the whole message and store it. Now, pretty simple as far as that goes for creating these. And when we go over here to manage extractors, this is where the parsing comes in with the PF sense. So if we actually wanna look at the parser, we can hit extract and it's a JSON file. Now, I actually have this same one that I'll leave a link to in my forum so you can just copy and paste this in because you can literally copy the extractors or import them, you just paste it in here. So any extractors that get built, they can be dropped in. I only have a couple in here right now. They're a little tricky to write because I'm not the best at Regex, but if you are, you can actually manually write these and there's a marketplace they have where you can find a lot of these in here. It can also be done with more than just Regex. They can be done with Grock and a few other things in terms of how you wanna parse the data. But this just takes the data that comes in and if it matches the PF sense filter log, that's all this is filtering, not all data that comes in PF sense, it parses it out into the fields. And this is what that looks like in action is just a string match. So filter log and it parses that out into this. And then right here, as a matter of fact, this one's UDP, so I'll actually change this. That's just a sample. You can load any log you want, but this is just for demonstration. We kinda get you an idea, UDP. And you can see this matches and then it assigns all these right here, which are all the different fields. It's just basically parsing as a CSV, assigning the field names with the delimiting character and putting all the data in there. All right, let's go back over to the inputs again. So that's how the PF sense comes in. Now, the Unify one, no extractors. We're just grabbing raw data from the Unify. And like I said, we can still parse it.  So this is what allows the data to flow. I've actually got debug logging turned on just because I needed more data. This is a demo lab I set up in Unify just for this particular video because we're gonna actually show how the correlation data works and how we can find things within it. Now I mentioned the streams for the next step. So the data comes in here and goes into the streams. But before you can set a stream up, you need to have the indexes. So here is the Indice and Index sets. Here is the default one. And I was doing some testing so there's actually a lot of data in the default one because if you just create something and turn it on, it'll just land in a default index until you parse it out with the stream. I have one called Unify and one called PF Sense. So there's two indexes here and two indexes here because it's doing a rotation. Now we're gonna actually create a new set in a second here and I'll show you how the rotation is handled but you can actually edit one of these, go down here by default. I have this set up to, I don't think that's a default. We'll look at the default when you set it up. Right now this is set up to one day of rotations and after 30 days, delete anything older than 30 days. You can actually change that by going here instead of saying time, we can say by size for example. We can say don't let this index get more than one gig. What happens? It rotates the index and after so many index rotations of one gig, it purges the next one there. So you can set it by size, you can set it by date. You can set it by message count. Only hold this many messages and then afterwards delete the index. This right here though where you have the option to archive the index, this is one of the enterprise features so archivification is disabled. Once again I said we're doing this all with the open source version of it. That's why that happens there. We're not gonna make any changes to this. PF sense one is the same set up. I bought both of these set up to a rotation of once per day and a number of indexes to 30 and after you're done, delete anything older than 30 days because that's all I really need to keep. Now we go over to the streams and this is where the filtering happens. So there's one called PF sense demo and Unify. The messages that come in from these, we'll go look at the actions. So we'll click on more actions, edit the stream. I called it Unify, Unify demo and this is the index set that this one lands on. Now the relationship is where the confusion may come in is how does that calling this one Unify and demo make it actually land on that index? That's where the rules come in. So you hit manage rules and there's a lot of options you can do for these rules. We're gonna do the most basic and that most basic is we're gonna open up a another window here called inputs and we'll go to the Unify and we'll hit show received messages. It's just one of the fastest ways to do this. Zoom in a little bit and we see right here, it says GL2 source input and we have this long number right here which we're just gonna copy. Let me go over here, zoom out so it's not quite so hard to read and we'll look at what this rule does. GL2 source input and by the way, it autocompletes as you start typing. So GL2 source input match exactly to this. So what this rule says is when the messages come in if they match this GL2 source input we will take them and send them to that particular index. This is what I was talking about right here where we have the stream data. If you don't have stream data lands in default if the stream matches a rule that we created such as GL2 source index equals those indexes that equal are going to be what streams it over there. But you could also create rules so we could add stream rule and because this parses out so many different things that we have in there like ICMP data, IP specific data so filter log data that I have, TCP flags for example you could create a rule, create a new index to say parse these and send them over if they match this. So you can create different indexes with very specific data. This is just a really nice feature and this is some of the flexibility I really like with Greylog. They give you very granular control. It seems like a lot but once you kind of get the flow of it you can start parsing certain things and maybe you want to keep certain data longer than others or just put all the data in one particular index for convenience and logging sake. So these are really nice features that they can do that. We're only going to create the one rule. Now we go back over here to the streams and we did the same thing here for the unified demo. So PF Sense demo, manage rules. There's that GL2 source must match exactly. If we go over here to system inputs and we look at the PF Sense you can just click again on the show receive messages. It's the fastest way to see what the GL2 source is. There's other ways you could find it but I just found click show messages it puts it up on there. By the way, let's go back over here to search where we actually see all the log data. And we can say search all messages within the last 30 minutes. Here's just raw all the data coming in by default it searches for everything. And that search query can be put just in here and it will instantly filter for that anyway. So if you did want to just filter for one particular thing the search query language is common across wherever you want it to work and et cetera from there. But now let's talk about creating a new one. So here's what it looks like for the existing ones and let's create a new one. I wanna actually take my XCP and G server and ingest all the logs from that. So we're gonna go here to gray log. First I wanna create a place for it to land. Let's create an index set and we'll call it XCP and G demo. Oops. All right, here's our XCP and G demo server analyzer standard index message count. We're gonna do this one by size. So I don't want these to get over one gig and I don't need that many. There's a lot of logs created by some of the virtualization servers. They maybe I don't need an archive of them. That's kind of an up to you thing. But once again, this is why we will want to put them in certain buckets because well storage is not unlimited. All right, we've created the place to land it. So we've created the index. Now we gotta create an input. So if we go over here to inputs we're gonna need to select our inputs. Now I said we're gonna be doing things in syslog but if you wanna do a lot of different options AWS flow, clog trail, kinesis, AWS logs, an older version beats, beats deprecated. There's actually a handful of different options and you go here to find more inputs. They have in a marketplace people who have wrote other functions and other features that you can grab off of GitHub. It's actually kind of cool. There's a lot of different things and there's a lot of support for things like let's say Palo, Palo Alto Networks, threat URL filtering, download from GitHub and there's just a link to the parser you can paste in there. So they give you quite a few things on the gray log marketplace so you can kind of find a few different things but that sometimes can create a problem because anyone can post in there. So if we search for PF sense there's a few different content packs for PF sense and I'll leave you the one that I'm using because they're not all the same and some of them are a little bit older that may have a little bit of issues working but if someone finds a better one that's a great discussion in my forums and if you link to something that's better than the ones I share, please let me know cause I'm still learning all of this even though I've been using it for a little while to parse data. So we've selected the input and we're gonna choose syslog UDP, launch new input, XCP, NG, demo, what's the port? We'll go 1566. I just like that number, store a full message. Really straightforward. We gave it a name, we set a port up unless these are something you need to tweak for the most part the default should work other than in special circumstances. Now we're ready to start receiving data. Now before I receive the data cause it'll just land in the default bucket I wanted to land in that new index instead of the default index but let's create a stream so it goes there. We're gonna do that by show receive messages open it in a new window. There's that GL2 source input again. Gonna go ahead and copy it. Streams, great stream. All this XCP and demo again and default index set. No, we wanna put it in XCP, G and demo and remove from all message stream. Yes, I don't wanna go in in both places but there may be times you do. This is one of those things that's why I said the diversity of the streams. You can create a stream that parses out some data out of another index drops it into another index but you may wanna leave it still there. So you have all of it in one place but then you have that extra data somewhere else just one of those options of why that lets you do that. So we're gonna hit save again. We're gonna go manage rules and we're going to add a stream role GL2 source input, paste that value that we have right here. So I left it open in another tab in case I forget it that's the value put that in description. If you want it save now when the data comes in it's gonna match that rule because it comes from that GL2 source which is the input source we defined and when we go here to inputs we'll see the data flowing through here. There's no extractors again we didn't do any type of extracting we're just gonna let it go and flow with unformatted raw data. So now we're gonna go here to XCP and G and put the server in which is right here on this page which is the host page specifically. Remote syslog server, 1566. So<PHONE_NUMBER>.1566 and now we can start ingesting logs from here and let's start making some logs by turning on this. This is the Windows 10 VM that I have in here and we can actually probably see right away some data moving. Yep, 1.3 kilobits. Let's go over here to search. There's all the data and let's filter it for just this right here. Clearly I did something wrong cause there's no data in here. Let's close this real quick and say let's search for this particular UUID which was the UUID we copied from here. Okay, the data is going to the default index set so I clearly just messed up the stream. Let's go back to the stream. Oh, I didn't start the stream. Whoops, there we go. Start stream.   There's a little play button right here to say update automatically and okay, now all the data's going once we started the stream. Some of that data is now left over the default index. But here we are and if we go back here and copy this again, let's filter for only data related to this particular VMs. We'll go ahead and stop it and we can see it now parsing that data and it's only giving me the data for this. It's pretty easy even though the data itself is unformatted so it's all just dropped right here into the message format. It's not parsed out into individual fields but you get the idea that even with that I can still index this and sort it and start understanding the data that's flowing through. Now let's go over and talk about the Unify side. So here's the data for that but we also put in the Unify system and the you have since demo system here. Oh, like that. At this, it plays so it automatically updates. Now some of the data such as the filter log data I'd mentioned we have that parsed. If we look here at the parse data for this it's all nice and organized not just dropped into a message. So we can say protocol TCP and we can then filter so we can maybe build statistics on it or add to a table we can actually say show top values. There are UDP and TCP so we have 1200 over this time period. Actually let's change the time period a little bit further. Start it updating again and you can see how we can start slicing the data up. There we go and we have that many over the last day and because we told it to keep updating it's still changing these counts as things go on. Now my phone's actually connected to the firewall behind this so we can probably open up stuff on my phone and let's do an update. If there's some app updates and this will probably make it go that much faster with all the connections that are going. Still not too much but like I said this is a lab environment so that's what's on there. Now speaking of my phone let's figure out what IP address my phone is by going over here firewall actually a DCP server under services and right there is Tom's phone <IP_ADDRESS>. Let's go back over to the gray log interface I got two of them open. Kind of start this over and we're going to find my phone's IP address and everything it's doing but right here we filtered for the IP address and once again here's the filter logs. Here's places it's contacting. I bet that's Google if I had to guess or where it probably looked up because I'm downloading some updates and source IP. So let's actually filter for add to query. So let's instead of just filtering free form we can go through and say source IP just for this particular piece of information in here and you can see it's going through the filter log and pulling up all that information. Now let's actually go specifically to the Unify and we'll query this again actually get rid of this, turn this on to update and I'm going to take my phone and drop it from the Wi-Fi and put it back on.  So now we can go through and say all right what's connecting to here and right there I can capture the MAC address and the IP assigned to it. So right there's the MAC address for my phone. So we'll go ahead and hit copy and we're just going to paste it up here. Show me the MAC address. Now let's add in the PF sense again then update the query. From here now we've got logs from both PF sense and from Unify going in one spot. And this gets kind of cool because this is that correlation data from two sources especially and I bring these two up because I know it's a popular question that comes up is when I'm having a DC problem looking at the logs from both devices the logs that are going on inside of Unify and the logs that are going on in PF sense simultaneously and walking through each device and parsing it out. This is where you can kind of get the information and consolidate it to try and troubleshoot some types of networking problem. Because if you didn't see the logs because we have a discover request right here from DHCP we actually start with right here the handshake. So custom wireless event I think we go a little further should be a wireless event that is the actual authorization. So let's go down right here says code W E zero do, do, do, do, do. All right, found it right here. Zoom in a little bit. Here is the first piece of this where it started the authentication for the WPA key. You can then start with the surrounding messages for up to 10 seconds around this open up a new window and start organizing the data, zoom it out so it's a little more on the screen and start organizing the data around it to try to sort out what happened. This is some of the ways I've really grown the love gray log as it allows me to do this relatively quickly and find certain pieces of data I'm looking for whether it be wifi data whether it be data in a syslog server from something else such as Apache from a web server putting all the logs in one place and be able to follow like from someone logging in on a VPN and figuring out what other servers they may have touched internally is great from a security standpoint and also from a troubleshooting standpoint. So hopefully this kind of gave you an idea how to get started with gray log. I will mention there is a whole bunch of dashboards that can be done. I've done a little bit of testing with it such as a building source dashboards and all kinds of analytics. I'm not great at it. Maybe in a future video I'll cover that but they do cover some more of this in their own documentation of how to set these up and how to build things like messages per source based on source of the filter logs, et cetera. Now also beyond the scope of this and something beyond the scope of me at the moment this will do threat intelligence looks up on your firewall. That's something that at some point I might get a little bit more into is actually using this for a deeper level of threat intelligence. Now the last thing I want to touch on is hardware what we have it running on and how it runs. This is a XC PNG server with an Intel Xeon E5 26070. Nothing outstanding in terms of processor does an older R720 server this particular machine is running on because it has a lot of storage to be able to store all the logs. Right now we have about 120 gigs worth of logs in our server and over here to the console for stats. I was playing around digging through stuff but generally speaking if we look over the last week it just does not use a lot of processor. It's not all that intensive on the processor. Now let's actually talk about what it looks like to pull some data. Right here we have H-top pulled up and you can see the load average is relatively low and here's the interface which we're looking at roughly four to five million logs coming in a day over the last 30 days. Let's find my IP address inside here. 168.3.9 We're gonna search back 30 days worth of logs and everywhere that it has a log where my IP address did something. You can see it's updating results. You can see the processor and the load going up a little bit while it does the query. And 30 days of results took a few seconds to do and you can see what days I was here or not here. I was really doing something on January 20th to generate quite a few logs that particular day but it's not a problem. It's even faster for doing things like when you say let's just say what did Tom do in the last two hours? That's pretty much instantaneous one day. Pretty much instantaneous 30 days. Well, we've did it, it's now indexed so it was able to pull it up relatively fast. We haven't really had any problems running it in production. It seems to work quite well. I haven't had any crashing issues or anything like that at all with it and it's not on the highest end of hardware that we have in our office. I did that on purpose. Well one because I had a lot of storage on it, our 720 server and two. I wanted to see how it handled or does it need something really high end to run and it turns out no, it really doesn't seem to. I've, even with the amount of logs that we ingest on it and as much data and it's going through the rotation because we mostly for most of the logs are purged out after only 30 days. That's all we need to keep for certain logs. We have longer for others, et cetera. But yeah, the system's been pretty stable. It survived a couple updates and hasn't given me any trouble. That's why I wanted to review it because the question comes up all the time about what do you use to ingest all your logging server? And I know there's a lot of people with home labs that are looking for, you know, kind of an easy setup log server and it gets you in started in that logging. So this is actually something I really recommend for people if you want to start out using your home lab, it's relatively easy to set up. You can just grab the OVA file and you can start just finding all the data that you have and all the different things you set up and just start piping it all there. Let me know in the forums because I'll leave a link to the JSON file that I have for my PF sense. But if you find some other really good use cases or extractors and other things that I didn't cover in this video that you would like me to do a follow-up video on, let me know. I will leave links of course to their documentation. It's pretty easy to go through that. They have a lot more tutorials on some of the, once you have it set up. That's why I wanted to make this getting started video to kind of try it out, learn with it, test it out and kind of wrap my head around how to get the data into it. But once you have the data into it, playing around as you can see is pretty easy to kind of sort out how you want to parse the data and just figuring out what dashboards you want to build and figure out what statistics you want to generate and of course, figuring out the extractors. I'm not great at REGX. I'm still going through all that. So if someone has a good suggestion on that or wants to help write some, I would probably hire someone to do some of that. It depends when you're watching this video whether or not I've got that accomplished or not. But leave a message. I'll leave a link to the forum post. That'll be the place to post that information. Thanks. And thank you for making it to the end of the video. If you liked this video, please give it a thumbs up. If you'd like to see more content from the channel, hit the subscribe button and hit the bell icon if you'd like YouTube to notify you when new videos come out. If you'd like to hire us, head over to laurancesystems.com fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on. If you want to carry on the discussion, head over to forums.laurancesystems.com where we can carry on the discussion about this video, other videos or other tech topics in general, even suggestions for new videos that are accepted right there on our forums, which are free. Also, if you'd like to help the channel in other ways, head over to our affiliate page. We have a lot of great tech offers for you. And once again, thanks for watching and see you next time.