开源日志服务器Graylog检测网络设备故障

Posted 2021-01-13

1、操作系统安装CentOS installation------省略
cat /etc/os-release ####配置主机的版本
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

关闭selinux
vim /etc/sysconfig/selinux
SELINUX=disable
2、java、数据库和Elasticsearch安装
1. java安装

$ sudo yum install java-1.8.0-openjdk-headless.x86_64
安装完后查看java版本
[[email protected] ~]# java -version
openjdk version "1.8.0_161"
OpenJDK Runtime Environment (build 1.8.0_161-b14)
OpenJDK 64-Bit Server VM (build 25.161-b14, mixed mode)

2. MongoDB安装
Vi /etc/yum.repos.d/mongodb-org-3.6.repo 进入编辑模式以后，增加以下配置：
[mongodb-org-3.6]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.6/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-3.6.asc
保存配置，退出以后
yum install -y mongodb-org.

$ sudo chkconfig --add mongod
$ sudo systemctl daemon-reload
$ sudo systemctl enable mongod.service
$ sudo systemctl start mongod.service
3.Elasticsearch
Graylog 2.4.x 必须使用Elasticsearch 5.x,
安装Elastic GPG key
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
vi /etc/yum.repos.d/elasticsearch.repo ####增加以下配置
[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

yum install elasticsearch ####安装elasticsearch
vi /etc/elasticsearch/elasticsearch.yml #####进入elasticsearch 配置文件，配置cluster.name，该cluster.name的名称要和graylog一致
cluster.name: graylog2

$ sudo chkconfig --add elasticsearch
$ sudo systemctl daemon-reload
$ sudo systemctl enable elasticsearch.service
$ sudo systemctl restart elasticsearch.service
Graylog

$ sudo rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-2.4-repository_latest.rpm
$ sudo yum install graylog-server #####安装graylog-server
pwgen -N 1 -s 96 ################获取password_secret
echo -n yourpassword | shasum -a 256 ##############获取root_password_sha2

vi /etc/graylog/server/server.conf
password_secret=uz8DP8HFBJtNtwySQdNxhjlU4PfqSbSKjnRk4MHXlfFdJKfsHmyekzMkkJ7CNoSnUGpGqD8P0euzy41rHsR39yKUZoSX0OAG
root_password_sha2=e3c652f0ba0b4801205814f8b6bc49672c4c74e25b497770bb89b22cdeb4e951
?elasticsearch_index_prefix = graylog2? ########和?elasticsearch配置的名称要一致
web_listen_uri = http://0.0.0.0:9000/
rest_listen_uri = http://0.0.0.0:9000/api/
elasticsearch_shards = 1
elasticsearch_replicas = 0
mongodb_useauth = false

$ sudo chkconfig --add graylog-server
$ sudo systemctl daemon-reload
$ sudo systemctl enable graylog-server.service
$ sudo systemctl start graylog-server.service
4、收集网络设备
Graylog收集网络设备日志
Centos7默认运行了rsyslog
vi /etc/rsyslog.conf
$ModLoad imudp ##############将原有的注释#去掉
$UDPServerRun 514 ##############将原有的注释#去掉
. @127.0.0.1:1514 转发给graylog
systemctl restart rsyslog.service ##########重启rsyslog服务

访问http:x.x.x.x:9000 用户名admin 密码yourpassword
配置input端口为1514，Linux下非root用户无法使用1024以下端口的解决方法，因此尽量使用1024以上的端口。

1) 创建test的dashboard

2) 搜索关键字

3) 保存到dashboard中

4) 打开dashhboards