anchor.diff:  :caution-caption: :fire:
   :warning-caption: :warning:
   else::[]
  -:icons: font 
  +:icons: font
   endif::[]
   :experimental:
   
   
  -This build was created and tested using CentOS 7.3. I pretty much guarantee that it won't work with anything else other than RHEL 7.  Unless you have an operational need, I would suggest basing your system off of CentOS 7.3 (build 1611), as that is where the bulk of the testing of this has happened.
  -
  -**BE ADVISED:**  This build process takes 3-10 minutes depending on your underlying hardware.  There will be times where it seems like it quit.  Be patient.  You'll know when it's done, for better or worse.
  -
  -### Differences in ROCK 2.0
  -
  -See [Getting Started with ROCK 2.0](docs/guide/getting-started.adoc).
  -
  -### Vagrant
  -**NOTE:**
  -This Vagrantfile is configured to give the VM 8GB of RAM.  If your system can't do that you should buy a new system or adjust the `vm.memory` value.  Anything below 8 is going to run like poopoo. You will also need to have a host-only adapter configured named `vboxnet0`.
  -``` 
  +This build was created and tested using CentOS 7.3. I pretty much guarantee that it won't work with anything else other than RHEL 7. Unless you have an operational need, I would suggest basing your system off of CentOS 7.3 (build 1611), as that is where the bulk of the testing of this has happened.
  +
  +NOTE: If your build isn't working, please review the <<hardware-requirements,Hardware Requirements>> and <<autodetect-assumptions,Autodetect Assumptions>>. The auto-generation script has to make some assumptions.
  +
  +**BE ADVISED:** This build process takes 3-10 minutes depending on your underlying hardware. There will be times where it seems like it quit. Be patient. You'll know when it's done, for better or worse.
  +
  +[[hardware-requirements]]
  +== Hardware Requirements
  +_(For anything other than a Vagrant build)_
  +
  +NOTE: This is a shadow of a recommendation of a guideline. Your mileage may vary. No returns or refunds.
  +
  +* CPU
  +* 4 or more physical cores.
  +* Memory
  +* 16GB (You can get away with 8GB, but it won't collect for long.)
  +* Storage
  +* 256GB, with 200+ of that dedicated to `/data`. Honestly, throw everything you can at it. The higher the IOPS the better.
  +* Network
  +* The system needs at least 2 network interfaces, one for management and one for collection.
  +
  +**GOLDEN RULE:** If you throw hardware at it, ROCK will use it. It will require some tuning to do so, but we'll continue documenting that.
  +[[autodetect-assumptions]]
  +== Autodetect Assumptions
  +
  +When writing the scripts to generate default values, we had to make some assumptions. The defaults are generated according to these assumptions and should generally work if your sensor aligns with them. That said, these assumptions will give you a working sensor, but may need some love for higher performance. If you cannot meet these assumptions, look at the indicated configuration variables in `/etc/rocknsm/config.yml` for workaround approaches (with impact on performance).
  +
  +* You have two network interfaces:
  +** A management interface with a default route
  +** An interface without a default route (defined by `rock_monifs`)
  +
  +TIP: We assume that any interface that does not have a default route will be used for collection. Each sensor application will be configured accordingly.
  +
  +WARNING: This so far has been the number one problem with a fresh install for beta testers!! Check your interface configuration!!
  +
  +* You have mounted your largest storage volume(s) under `/data/` (defined by `rock_data_dir`)
  +* Your hostname (FQDN) is defined in the `ansible/inventory/all-in-one.ini` file.
  +* You allow management via SSH from any network (defined by `rock_mgmt_nets`)
  +* You wish to use Bro, Suricata, Stenographer (disabled by default) and the whole data pipeline. (See `with_*` options)
  +* If installed via ISO, you will perform an offline install, else we assume online (defined by `rock_online_install`)j
  +* Bro will use half of your CPU resources, up to 8 CPUs
  +
  +== Differences in ROCK 2.0
  +
  +See link:docs/guide/getting-started.adoc[Getting Started with ROCK 2.0].
  +
  +== Vagrant
  +
  +This Vagrantfile is configured to give the VM 8GB of RAM. If your system can't do that you should buy a new system or adjust the `vm.memory` value. Anything below 8 is going to run like poopoo. You will also need to have a host-only adapter configured named `vboxnet0`.
  +
  +```
   git clone https://github.com/rocknsm/rock.git
   cd rock
   vagrant up
   ```
   
  -### Physical/Virtual/Non-Vagrant
  -**NOTE:**   
  -The system you run this on should have at least 2 network interfaces and more than 8GB of RAM, with an OS (RHEL or CentOS 7) already installed.
  +== Physical/Virtual/Non-Vagrant
  +
  +The system you run this on should have at least 2 network interfaces and more than 8GB of RAM, with an OS (RHEL or CentOS 7) already installed. See the <<hardware-requirements,Hardware Requirements>> section for details.
   ```
   sudo yum update -y && reboot
   sudo yum install -y epel-release
   sudo yum install -y git ansible
   git clone https://github.com/rocknsm/rock.git
   cd rock/ansible
  +sudo ./generate_defaults.sh
   sudo ./deploy_rock.sh
   ```
   
  -## Minimum Hardware Recommendations 
  -#### (For anything other than a Vagrant build)
  -
  -**NOTE:** This is a shadow of a recommendation of a guideline.  Your mileage may vary.  No returns or refunds.
  -
  -*  CPU
  -  *  4 or more physical cores.  
  -*  Memory
  -  *  16GB (You can get away with 8GB, but it won't collect for long.)
  -*  Storage
  -  *  256GB, with 200+ of that dedicated to `/data`. Honestly, throw everything you can at it.  The higher the IOPS the better.
  -*  Network
  -  *  The system needs at least 2 network interfaces, one for management and one for collection.
  -
  -**GOLDEN RULE:** If you throw hardware at it, ROCK will use it.  It will require some tuning to do so, but we'll be documenting that soon enough.
  -
  -## Usage
  -
  -#### Start / Stop / Status
  +== Usage
  +
  +=== Start / Stop / Status
   Accomplished with `rock_stop`, `rock_start`, and `rock_status`.
   
  -**NOTE:** These may need to be prefaced with /usr/local/bin/ depending on your PATH.
  +TIP: These may need to be prefaced with /usr/local/bin/ depending on your PATH.
   
   `sudo rock_stop`
   ```
  
positive.code: ```
  [root@simplerockbuild ~]# rock_start
  Starting Zookeeper...
     Active: active (running) since Wed 2015-12-02 17:12:02 UTC; 5s ago
  Starting Elasticsearch...
     Active: active (running) since Wed 2015-12-02 17:12:07 UTC; 5s ago
  Starting Kafka...
     Active: active (running) since Wed 2015-12-02 17:12:12 UTC; 5s ago
  Starting Logstash...
     Active: active (running) since Wed 2015-12-02 17:12:17 UTC; 5s ago
  Starting Kibana...
     Active: active (running) since Wed 2015-12-02 17:12:22 UTC; 5s ago
  Starting Bro...
  removing old policies in /data/bro/spool/installed-scripts-do-not-touch/site ...
  removing old policies in /data/bro/spool/installed-scripts-do-not-touch/auto ...
  
negative.code: starting worker-1-2 ...
  Getting process status ...
  Getting peer status ...
  Name Type Host Status Pid Peers Started
  manager manager localhost running 20389 ??? 02 Dec 17:12:34
  proxy-1 proxy localhost running 20438 ??? 02 Dec 17:12:35
  worker-1-1 worker localhost running 20484 ??? 02 Dec 17:12:36
  worker-1-2 worker localhost running 20485 ??? 02 Dec 17:12:36
  ```
  
  `sudo rock_status`
  ```
  [root@simplerockbuild ~]# /usr/local/bin/rock_status
  ✓ Check each monitor interface is live
  ✓ Check for interface errors
  ✓ Check monitor interface for tx packets
  ✓ Check PF_RING settings
  ✓ Check that broctl is running
  ✓ Check for bro-detected packet loss
  ✓ Check that zookeeper is running
  ✓ Check that zookeeper is listening
  ✓ Check that client can connect to zookeeper
  ✓ Check that kafka is running
  ✓ Check that kafka is connected to zookeeper
  ✓ Check that logstash is running
  ✓ Check that elasticsearch is running
  ✓ Check that kibana is running
  
  14 tests, 0 failures
  ```
  
  == Basic Troubleshooting
  === Functions Check:
  ```
  # After the initial build, the ES cluster will be yellow because the marvel index will think it's missing a replica. Run this to fix this issue. This job will run from cron just after midnight every day.
  /usr/local/bin/es_cleanup.sh 2>&1 > /dev/null
  
  # Check to see that the ES cluster says it's green:
  curl -s localhost:9200/_cluster/health | jq '.'
  
  # See how many documents are in the indexes. The count should be non-zero.
  curl -s localhost:9200/_all/_count | jq '.'
  
  # You can fire some traffic across the sensor at this point to see if it's collecting.
  