Logloop Installation and Administration Guide

Transcription

1 Logloop Installation and Administration Guide Update 2017/07 Agenda Install and config Logloop Setup data pipelines Workshop: Create dashboards Install and config logloop Retrieve logloop package depends on the application, i.e. logloop-linux bin the package name: logloop-[edt]-[arch]-[yyyymm].bin [edt]: absent or contains a specific edition [arch]: the architecture [yyyymm]: the date-based the version number Copy to target servers or vms verify the package on the server with the checksum file if necessary, # replace the filename in example with the actual pa ckage file sha1sum -c logloop-linux bin.sha1 # output logloop-linux64-[yyyymm].bin: OK execute to unpack,

2 # replace the filename in example with the actual pa ckage file./logloop-linux64-[yyyymm].bin password: unpacked files go to logloop-install or logloop-[edt]-install folder under the current path if use a wrong password, then remove the unpacked folder and execute to enter the password again Install prerequisites: Docker install Docker packages from internet with the helper script./install-docker.sh ## verify: the service status systemctl status docker ## output: the service is enabled and active now docker.service - Docker Application Container Engi ne Loaded: loaded (/usr/lib/systemd/system/docker.se rvice; enabled...) Active: active (running) since... install Docker packages manually: please refer to the link below for information about different platforms the official installation guide Install logloop execute the install.sh command./install.sh # output setup services: logloop... installation completed

3 verify the default status of logloop service (the name is shown in the install.sh output) systemctl status logloop # output: the service is enabled and inactive now logloop.service - logloop service Loaded: loaded (/etc/systemd/system/logloop.servi ce; enabled...) Active: inactive (dead) start logloop and verify again sudo systemctl start logloop # verify: the service status systemctl status logloop # output: the service is active now logloop.service - logloop service Loaded: loaded (/etc/systemd/system/logloop.servi ce; enabled...) Active: active (running) since... enable logloop for auto-start at boot time sudo systemctl enable logloop # verify: the service status systemctl status logloop # output: the service is enabled now logloop.service - logloop service Loaded: loaded (/etc/systemd/system/logloop.servi ce; enabled...) Active: active (running) since... open in the browser install beats dashboard templates./post-install.sh

4 Add the auto-generated certificate as trusted in the browser Chrome: View > Developer options > Developer tools > Security tab (or click on >> option): View certificate: drag and drop the certificate icon to the desktop to save it double-click the.cer file to import it into the system Summary Running service Service port Options in logloop.yml Beats 5043/TCP bt_host, bt_port Kibana 8443/HTTPS web_host, web_port, web_user, web_passwd Logstash - ls_filter Beats client 5043/TCP Logloop:ELK Web client 8443/HTTPS

5 Details of the config file logloop.yml default path: /opt/logloop/config/logloop.yml # Config web/kibana service # - default host: any:8443 # - login: webadmin / webadmin@[year] # - default ssl option: auto (set it "off" to trun o ff) web_host: " " web_port: 8443 web_user: "webadmin" web_passwd: "webadmin@yyyy" web_ssl: "auto"... # Config beats service port # - default host: any:5043 bt_host: " " bt_port: # Config ls filter rules # - default path: /opt/logstash/config/ls-filter.con f ls_filter: "/opt/logstash/config/ls-filter.conf" Setup data pipelines Example: System monitoring metrics with metricbeat

6 # metricbeat.yml # input section metricbeat.modules: - module: system metricsets: - cpu - load - diskio - filesystem - fsstat - memory - network - process enabled: true period: 10s processes: ['.*'] hosts: ["localhost:5043"] Example: Service monitoring with heartbeat # heartbeat.yml # input section heartbeat.monitors: - type: http urls: [" schedule: '@every 30s' hosts: ["localhost:5043"] Example: File-based logging with filebeat

7 # filebeat.yml # input section filebeat.prospectors: - input_type: log paths: - /var/log/*.log - /tmp/*.log hosts: ["localhost:5043"] beats client authentication add to the output section of beats config file hosts: ["localhost:5044"] ssl.certificate_authorities: ["/etc/ca.crt"] ssl.certificate: "/etc/client.crt" ssl.key: "/etc/client.key" ref. Create dashboards Workshop Make sure beats dashboard templates is installed./post-install.sh