zoukankan      html  css  js  c++  java
  • ELK(日志审计系统)

    ELk简介及工作流程

      ELK即(Elasticsearch + Logstash + Kibana)

    下载安装包

    • 系统环境:Contos7.0
    • Java环境:Portal(这是历史下载地址,我的是 jdk-8u151-linux-x64.tar.gz
    • Logstash/Elasticsearch/Kibana/Filebeat:Portal(我都是选的7.0版本)
    • redis:Portal

     

    下载完成后传到服务器,全部解压至“/etc/elk”目录下,注意:这里使用的是单机部署(内存应不低于2G)

    Java环境配置

    tar -zvxf jdk-8u151-linux-x64.tar.gz -C /data/app/
    ln -s /data/app/jdk1.8.0_151 /data/app/jdk
    cat <<EOF >> /etc/profile   # 追加文件
    """
    export JAVA_HOME=/data/app/jdk
    PATH=$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$PATH
    CLASSPATH=.$CLASSPATH:$JAVA_HOME/lib:$JAVA_HOME/jre/lib:$JAVA_HOME/lib/tools.jar
    EOF
    """
    source /etc/profile
    ln -s /data/app/jdk/bin/java /usr/bin/java 
    java -version        # 查看是否安装成功
    
            
    命令

    elasticsearch部署

    elasticsearch安装

    rpm -ivh elasticsearch-7.0.0-x86_64.rpm 
    # 编辑配置文件
    vim /etc/elasticsearch/elasticsearch.yml
    """
    path.logs: /var/log/elasticsearch
    cluster.name: elk01
    node.name: node-1
    path.data: /var/lib/elasticsearch
    path.logs: /var/log/elasticsearch
    network.host: 0.0.0.0
    http.port: 9200
    discovery.seed_hosts: ["10.60.53.143",]
    cluster.initial_master_nodes: ["10.60.53.143",]
    """
    # 具体作用可以看配置文件中的英文解释
    systemctl restart elasticsearch  # 启动服务
    npm安装步骤

    logstash部署

    rpm -ivh logstash-7.0.0.rpm

    更新中..................

    kibana部署

    rpm -ivh kibana-7.0.0-x86_64.rpm
    # 编辑配置文件
    vim /etc/kibana/kibana.yml
    """
    server.port: 5601
    server.host: "0.0.0.0"
    elasticsearch.hosts: ["http://10.60.53.143:9200"]
    """
    # 启动
    systemctl  start kibana
    systemctl  enable  kibana

    filebeat部署

    安装

    rpm -ivh filebeat-7.0.0-x86_64.rpm 

    修改filebeat配置文件“filebeat.yml” and Redis配置文件"6379.conf"

    • filebeat没有运行日志,直接查看系统messages运行日志即可。
    • 配置好filebeat后一定要重启。
    • 重启后查看redis中是否有值,有值则正常。
    # 注销bind字段,将protected-mode设置为no
    # bind 127.0.0.1
    protected-mode no
    /etc/redis/6379.conf
    filebeat.inputs:
    - type: log
      paths:
        - /root/channelHandle-out-2.log
      fields:
        log_file: xsj_channelhandle_out_2
        log_type: a-out-log
      fields_under_root: true
      encoding: utf-8
    processors:
      - drop_event:
          when.not.contains:
            message: "收到"
    output.redis:
      hosts: ["10.60.53.143:6379"]
      db: 0
      # password: "1234@abcd.com"
      key: "%{[log_file]:xsj}"
      timeout: 5
    etc/filebeat/filebaet.yml

    相关命令

    systemctl  start     filebeat
    systemctl  enable  filebeat
    systemctl  restart  filebeat
    启动关闭重启
  • 相关阅读:
    sharepoint custom web service
    网站模板创建报错
    sharepoint 2013 持续爬网
    使用 SQL的 for xml path来进行字符串拼接 (group by)
    sharepoint 修改AD密码
    SharePoint 2013 BCS
    系统补丁对sharepoint很重要
    SharePoint 2010: Export User Profile Properties to a Text File or Excel using PowerShell
    SharePoint2013 错误
    sharepoint 开发相关工具总结
  • 原文地址:https://www.cnblogs.com/Dream-huang/p/10954811.html
Copyright © 2011-2022 走看看