Monitor Cassandra audit log

Transcription

1 Monitor Cassandra audit log This is a tutorial about how to create a new eagle application step by step, though it is using cassandra query monitoring as example, but it could be extended to any log-based monitoring cases. 1. Flow Stream into Kafka 2. Startup Eagle Server 3. Create New Monitoring Application 4. Start Monitoring Topology 5. Validate with Sample Policy a. Define sample policy with eagle b. Trigger alert with sample event c. Review generated alert 1. Flow Stream into Kafka Raw Query Log Sample: host:/ source:/ user:cassandra timestamp: category:query type:cql_select ks:dg_keyspace cf: customer_details operation:select id,name, ,contact from customer_details masked_columns:[ ,contact] other_columns:[id,name] Create Kafka topic: cassandra_querylog_sandbox $KAFKA_HOME/bin/kafka-topics.sh --create --topic cassandra_querylog_sandbox --zookeeper localhost: partitions 1 -- replication-factor 1 Parsed Query Log and Flow into Kafka "host": "/ ", "source": "/ ", "user": "jaspa", "timestamp": , "category": "QUERY", "type": "CQL_SELECT", "ks": "dg_keyspace", "cf": "customer_details", "operation": "CQL_SELECT", "masked_columns": "bank ccno ip name sal ssn tel url", "other_columns": "id npi" 2. Startup Eagle Server

2 $EAGLE_HOME/bin/eagle-service.sh start 3. Create New Monitoring Application Site: sandbox Application: Group: Cassandra Name: cassandraquerylog Source Stream: Name: cassandraquerylogstream Executor: cassandraquerylogexecutor Schema: cf string query column family ks string query keyspace host string the host that current metric comes form type string query type user string query user category string query category timestamp long query timestamp masked_columns string query masked_columns operation string query operation other_columns string query other_columns source string source host Here is the script for defining the metadata CassandraQueryLogMonitorMetadata.sh # EAGLE_SERVICE_HOST, default is `hostname -f`

3 export EAGLE_SERVICE_HOST=localhost # EAGLE_SERVICE_PORT, default is 9099 export EAGLE_SERVICE_PORT=9099 # EAGLE_SERVICE_USER export EAGLE_SERVICE_USER=admin # EAGLE_SERVICE_PASSWORD export EAGLE_SERVICE_PASSWD=secret curl -u $EAGLE_SERVICE_USER:$EAGLE_SERVICE_PASSWD -X POST -H 'Content- Type:application/json' \ " /entities?servicename=siteapplicationservice" \ -d ' [ "tags": "site":"sandbox", "application":"cassandraquerylog" "enabled": true, "config": "" ] ' curl -u $EAGLE_SERVICE_USER:$EAGLE_SERVICE_PASSWD -X POST -H 'Content- Type:application/json' \ " /entities?servicename=applicationdescservice" \ -d ' [ "tags": "application":"cassandraquerylog" "description":"cassandra Query Log Monitoring", "alias":"querylogmonitor", "groupname":"cassandra", "config":"", "features":["common","metadata"] ] ' ## AlertStreamService echo "" echo "Importing AlertStreamService for HDFS... " curl -u $EAGLE_SERVICE_USER:$EAGLE_SERVICE_PASSWD -X POST -H 'Content- Type:application/json' \ " /entities?servicename=alertstreamservice" \ -d ' [ "tags": "application":"cassandraquerylog",

4 "streamname":"cassandraquerylogstream" "description":"cassandra query log data source stream" ] ' ## AlertExecutorService: what alert streams are consumed by alert executor echo "" echo "Importing AlertExecutorService for HDFS... " curl -u $EAGLE_SERVICE_USER:$EAGLE_SERVICE_PASSWD -X POST -H 'Content- Type:application/json' \ " /entities?servicename=alertexecutorservice" \ -d ' [ "tags": "application":"cassandraquerylog", "alertexecutorid":"cassandraquerylogexecutor", "streamname":"cassandraquerylogstream" "description":"executor for cassandra query log stream" ] ' ## AlertStreamSchemaService: schema for event from alert stream echo "" echo "Importing AlertStreamSchemaService for HDFS... " curl -u $EAGLE_SERVICE_USER:$EAGLE_SERVICE_PASSWD -X POST -H 'Content- Type:application/json' \ " /entities?servicename=alertstreamschemaservice" \ -d ' [ "tags": "attrname": "host" "attrdescription": "the host that current metric comes form", "tags": "attrname": "source" "attrdescription": "source host",

5 "tags": "attrname": "user" "attrdescription": "query user", "tags": "attrname": "timestamp" "attrdescription": "query timestamp", "attrtype": "long", "tags": "attrname": "category" "attrdescription": "query category", "tags": "attrname": "type" "attrdescription": "query type", "tags": "attrname": "ks"

6 "attrdescription": "query keyspace", "tags": "attrname": "cf" "attrdescription": "query column family", "tags": "attrname": "operation" "attrdescription": "query operation", "tags": "attrname": "masked_columns" "attrdescription": "query masked_columns", "tags": "attrname": "other_columns" "attrdescription": "query other_columns", ] ' ## Finished echo ""

7 echo "Finished initialization for eagle topology" After successfully loading above metadata, the new application of Cassandra Query Monitoring Application could be found in Eagle Web after refreshing the page as following: 4. Start Monitoring Topology 1. Create a new topology configuration file named "cassandra-querylog-sandbox.conf" to connect source kafka topic: cassandra_querylog_sandbox as following: cassandra-querylog-sandbox.conf # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to You under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at # # # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. "envcontextconfig" : "env" : "storm", "mode" : "cluster", "topologyname" : "cassandrawquerylogmonitortopology",

8 "stormconfigfile" : "cassandraw-querlog-storm.yaml", "parallelismconfig" : "cassandraquerylogstream" : 1, "cassandraquerylogexecutor*" : 1 "datasourceconfig": "topic" : "cassandra_querylog_sandbox", "zkconnection" : "sandbox.hortonworks.com:2181", "zkconnectiontimeoutms" : 15000, "consumergroupid" : "eagle.consumer", "fetchsize" : , "deserializerclass" : "org.apache.eagle.datastream.storm. JsonMessageDeserializer", "transactionzkservers" : "sandbox.hortonworks.com", "transactionzkport" : 2181, "transactionzkroot" : "/consumers", "transactionstateupdatems" : 2000 "alertexecutorconfigs" : "cassandraquerylogexecutor" : "parallelism" : 1, "partitioner" : "org.apache.eagle.policy. DefaultPolicyPartitioner" "needvalidation" : "true" "eagleprops" : "site" : "sandbox", "datajoinpollintervalsec" : 30, "mailhost" : "mailhost.com", "mailsmtpport":"25", "maildebug" : "true", "balancepartitionenabled" : true, #"partitionrefreshintervalinmin" : 60, #"kafkastatisticrangeinmin" : 60, "eagleservice": "host": "localhost", "port": 9099, "username": "admin", "password": "secret" "readhdfsusercommandpatternfrom" : "file" "dynamicconfigsource" : "enabled" : true, "initdelaymillis" : 0, "delaymillis" : 30000

9 2. Start monitoring topology./bin/kafka-stream-monitor.sh cassandraquerylogstream cassandraquerylogexecutor cassandra-querylog-sandbox.conf 5. Validate with Sample Policy a. Define sample policy with eagle from cassandraquerylogstream[(ks == 'dg_keyspace') and (cf == 'customer_details')] select * insert into outputstream; b. Trigger alert with sample event $ $KAFKA_HOME/bin/kafka-console-producer.sh --topic cassandra_querylog_sandbox --broker-list sandbox.hortonworks.com:6667 "host": "/ ","source": "/ ","user": "jaspa", "timestamp": , "category": "QUERY", "type": "CQL_SELECT", "ks": "dg_keyspace","cf": "customer_details","operation": "CQL_SELECT","masked_columns": "bank ccno ip name sal ssn tel url"," other_columns": "id npi" c. Review generated alert

10