Stopping All Metron Services
You need to stop all Metron services prior to uninstalling Metron.
Stop all Metron services in Ambari.
Stop each Metron service in the following order:
Metron Alerts UI
Metron Management UI
Metron REST
Storm
To stop Storm, complete the following steps:
Kill each Storm topology.
From the Storm node, list all of the Storm topologies that are currently running:
storm list
Kill each of the running Storm topologies in the following order:
all parsers such as bro and snort
enrichment
indexing
profiler
For example:
storm kill bro
Return to the Storm UI.
Verify that all topologies are killed.
In Ambari, stop Storm by selecting Storm and clicking Stop All in the Actions menu.
Ensure that the UIs are shut down.
If the Metron Alerts Ui or Metron Management UI status in Ambari is "running," shut down the UIs by entering the following from
$METRON_HOME/var/log/metron/metron
:service metron-alerts-ui status service metron-alerts-ui stop service metron-management-ui status service metron-management-ui stop