graylog 客戶端的安裝配置

Graylog2 是一個日誌收集伺服器，可以當做 syslog 伺服器使，支援 TCP、UDP 協議。另外也支援以 TCP/UDP 方式接收 GELF 格式的日誌，這個格式很簡單，就是一個 JSON 字串。Graylog2 把 GELF 格式的日誌存入 ElasticSearch 中，另外往 MongoDB 裡寫入一些統計資訊，伊提供了一個 Ruby 寫的 Web 應用，可以搜尋日誌並視覺化的顯示搜尋結果的時間分佈。

說道搭建，graylog的服務端才是最複雜的，在此不加詳述（其實我也不太會），這裡就總結一下客戶端的安裝和配置。

下面就來看看graylog如何安裝。

在這裡，筆者用的ansible工具一鍵安裝，具體的ansible用法可以參考官方文件

http://docs.ansible.com/ansible/

一、客戶端安裝：

這裡只給出部分ansible指令碼：

1、tasks 目錄下的install.yml：

- name: Yum Install Initializtion Require Software

  yum: name=libdbi.x86_64 state=installed

  when: ansible_os_family == "RedHat"

- name: Download collector-sidecar_0.0.8-1_amd64.rpm

  get_url: url=https://github.com/Graylog2/collector-sidecar/releases/download/0.0.8/collector-sidecar-0.0.8-1.x86_64.rpm dest=/tmp/

  when: ansible_os_family == "RedHat"

- name: Install collector-sidecar_0.0.8-1_amd64.rpm

  yum: name=/tmp/collector-sidecar-0.0.8-1.x86_64.rpm state=present

  when: ansible_os_family == "RedHat"

- name: Download nxlog-ce_2.9.1716_ubuntu_1404_amd64.rpm

  get_url: url=https://nxlog.co/system/files/products/files/1/nxlog-ce-2.9.1716-1_rhel6.x86_64.rpm dest=/tmp/

  when: ansible_os_family == "RedHat"

- name: Install nxlog-ce-2.9.1716-1_rhel6.x86_64.rpm

  yum: name=/tmp/nxlog-ce-2.9.1716-1_rhel6.x86_64.rpm state=present

  when: ansible_os_family == "RedHat"

- name: Install Graylog-collector-sidecat-service

  shell: graylog-collector-sidecar -service install

  when: ansible_os_family == "RedHat"

  ignore_errors: yes

- name: Change the Limits Of Authority

  file: path=/var/log/graylog owner=nxlog group=nxlog mode=0755 recurse=yes

  when: ansible_os_family == "RedHat"

- name: Start The Collector-sidecat 

  service: name=collector-sidecar state=restarted

  when: ansible_os_family == "RedHat"

- name: Download nxlog-ce_2.9.1716_ubuntu_1404_amd64.deb

  get_url: url=https://nxlog.co/system/files/products/files/1/nxlog-ce_2.9.1716_ubuntu_1404_amd64.deb dest=/tmp/

  when: ansible_os_family == "Debian"

- name: Install nxlog-ce_2.9.1716_ubuntu_1404_amd64.deb

  apt: deb=/tmp/nxlog-ce_2.9.1716_ubuntu_1404_amd64.deb

  when: ansible_os_family == "Debian"

- name: Download collector-sidecar_0.0.8-1_amd64.deb

  get_url: url=https://github.com/Graylog2/collector-sidecar/releases/download/0.0.8/collector-sidecar_0.0.8-1_amd64.deb dest=/tmp/

  when: ansible_os_family == "Debian"

- name: Install collector-sidecar_0.0.8-1_amd64.deb

  apt: deb=/tmp/collector-sidecar_0.0.8-1_amd64.deb

  when: ansible_os_family == "Debian"

- name: Copy Collector_sidercat Configure file Client

  template: src=collector_sidecar.yml dest=/etc/graylog/collector-sidecar/collector_sidecar.yml owner=root group=root mode=0644

  when: ansible_os_family == "Debian"

- name: Install Graylog-collector-sidecat-service

  shell: graylog-collector-sidecar -service install

  when: ansible_os_family == "Debian"

  ignore_errors: yes

- name: Change user and group of /var/spool/collector-sidecar/ 

  file: path=/var/spool/collector-sidecar/ owner=nxlog group=nxlog mode=0755 recurse=yes

  when: ansible_os_family == "Debian"

- name: Change user and group of /var/run/graylog

  file: path=/var/run/graylog owner=nxlog group=nxlog mode=0755 recurse=yes

  when: ansible_os_family == "Debian"

- name: Start The Collector-sidecat

  service: name=collector-sidecar state=restarted

  when: ansible_os_family == "Debian"

2、graylog客戶端的配置檔案：

server_url: ` server_url `      //graylog客戶端的ip與埠，預設埠為12900

tls_skip_verify: false

node_id: ` node_id `          //通過node_id來識別不同的機器組

collector_id: file:/etc/graylog/collector-sidecar/collector-id

tags: ` tags `                       //通過tags來識別不同的機器 

log_path: /var/log/graylog/collector-sidecar

update_interval: 10

log_rotation_time: 6000

log_max_age: 12000

backends:

  - name: nxlog

    enabled: true

    binary_path: /usr/bin/nxlog

    configuration_path: /etc/graylog/collector-sidecar/generated/nxlog.conf (edited)

注意：定義的配置檔案的路徑，有錯時需要在配置檔案中尋找日誌進行排查

二、web端配置：

1、在https://ip/system/collectors/configurations/下建立一個新的配置檔案，其中tags要和配置檔案中的保持一致，node_id（即name）會自動獲取配置檔案（/etc/graylog/collector-sidecar/collector_sidecar.yml）中的內容

2、在新建立的配置檔案中，create input output 以及 snippet。

注意：

a、output 中的埠與graylog的監聽埠不一樣，這個埠是用來進行資料傳輸的，要保證這個埠是開啟的。

b、input 中主要是要匯入的日誌路徑，這個日誌路徑一定要正確，並且具有讀許可權。

c、snippet 中最關鍵的是定義的客戶端的模組路徑（“Moduledir /usr/libexec/nxlog/modules”），需要根據客戶端的實際路徑來修改。

三、排錯方法：

1、使用‘graylog-collector-sidecar -c /etc/graylog/collector-sidecar/collector_sidecar.yml’校驗collector-sidecar配置檔案是否正確，並檢視‘/var/log/collector-sidecar.err'或者'/var/log/messages'來獲取錯誤詳情。

2、使用‘nxlog -v -f /etc/graylog/collector-sidecar/generated/nxlog.conf’來檢視nxlog配置檔案是否正確，對應的日誌檔案為'/var/log/graylog/collector-sidercar/nxlog.log'。