GrayLog日志平台的基本使用-Windows日志接入

## 什么是graylog Graylog 是一个简单易用、功能较全面的日志管理工具，相比 ELK 组合， 优点： - 部署维护简单 - 查询语法简单易懂(对比ES的语法…) - 内置简单的告警 - 可以将搜索结果导出为 json - 提供简单的聚合统计功能 - UI 比较友好 - 当然， 拓展性上比 ELK 差很多。 整套依赖： - Graylog 提供 graylog 对外接口 - Elasticsearch 日志文件的持久化存储和检索 - MongoDB 只是存储一些 Graylog 的配置 ## 安装 > 可以是裸机安装，也可以是docker安装，这里用docker安装 环境要求: - centos7.4 - cpu2个 内存2G 参考: https://hub.docker.com/r/graylog2/graylog/ ### 环境准备 ``` mkdir /root/graylog && cd /root/graylog //挂载目录 mkdir -p mongo_data graylog_journal es_data //配置文件目录 mkdir -p ./graylog/config cd ./graylog/config wget https://raw.githubusercontent.com/Graylog2/graylog-docker/3.0/config/graylog.conf wget https://raw.githubusercontent.com/Graylog2/graylog-docker/3.0/config/log4j2.xml //提前准备镜像 docker pull mongo:3 docker pull graylog/graylog:3.0 docker pull elasticsearch:5.6.9 ``` ### docker-compose.yml ``` version: '2' services: # MongoDB: https://hub.docker.com/_/mongo/ mongo: image: mongo:3 volumes: - ./mongo_data:/data/db - /etc/localtime:/etc/localtime # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/docker.html elasticsearch: image: elasticsearch:5.6.9 volumes: - ./es_data:/usr/share/elasticsearch/data - /etc/localtime:/etc/localtime environment: - http.host=0.0.0.0 - transport.host=localhost - network.host=0.0.0.0 # Disable X-Pack security: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/security-settings.html#general-security-settings - xpack.security.enabled=false - "ES_JAVA_OPTS=-Xms512m -Xmx512m" ulimits: memlock: soft: -1 hard: -1 mem_limit: 1g # Graylog: https://hub.docker.com/r/graylog/graylog/ graylog: image: graylog/graylog:3.0 volumes: - ./graylog_journal:/usr/share/graylog/data/journal - ./graylog/config:/usr/share/graylog/data/config - /etc/localtime:/etc/localtime environment: # CHANGE ME! - GRAYLOG_PASSWORD_SECRET=somepasswordpepper # Password: admin - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 # 这里需要修改为要暴露的机器的地址 - GRAYLOG_HTTP_EXTERNAL_URI=http://10.121.60.2:9000/ links: - mongo - elasticsearch ports: # Graylog web interface and REST API - 9000:9000 # Syslog TCP - 514:514 # Syslog UDP - 514:514/udp # GELF TCP - 12201:12201 # GELF UDP - 12201:12201/udp # GELF HTTP - 12202:12202 ``` ### 启动 `docker-compose -f docker-compose.yml up -d` 通过http://10.121.60.2:9000/访问web,admin/admin ### 修改配置 - email相关(告警需要) ``` transport_email_enabled = true transport_email_hostname = smtp.163.com transport_email_port = 994 transport_email_use_auth = true transport_email_use_tls = true transport_email_use_ssl = true transport_email_auth_username = [email protected] transport_email_auth_password = zhim123456 transport_email_subject_prefix = [graylog] transport_email_from_email = [email protected] transport_email_web_interface_url = http://10.121.60.2:9000 ``` ## 使用 ### 配置添加Inputs > Graylog 节点能够接受数据的类型称之为input，常见的有GELF TCP, GELF UDP, GELF HTTP. 说明：GELF TCP, GELF UDP可以使用同一个端口，HTTP需要另起端口，原因不解释。 - 添加三个input，过程略，tcp,udp端口使用默认的12201，http端口使用12202。 - 验证 ``` // udp echo -n '{ "version": "1.1", "host": "example.org", "short_message": "A short message info with udp", "level": 1, "_some_info": "foo", "_tag": "test11" }' | nc -w10 -u 10.121.60.2 12201 // tcp echo -n -e '{ "version": "1.1", "host": "example.org", "short_message": "A short message with tcp", "level": 1, "_some_info": "foo" }'"\0" | nc -w10 10.121.60.2 12201 //http curl -X POST -H 'Content-Type: application/json' -d '{ "version": "1.1", "host": "example.org", "short_message": "A short message with http", "level": 5, "_some_info": "foo" }' 'http://10.121.60.2:12202/gelf' ``` ### docker 日志添加到graylog ``` docker run --log-driver=gelf \ --log-opt gelf-address=udp://10.121.60.2:12201 \ --log-opt tag=test1 \ -v /etc/localtime:/etc/localtime \ -it nginx /bin/bash ``` docker-compose.yaml ``` services: mongo: logging: driver: "gelf" options: gelf-address: "udp://10.121.60.2:12201" tag: mongo volumes: - /etc/localtime:/etc/localtime ``` ### java日志直接发送到graylog > 使用logback ``` 10.121.60.2 12201 <!--An example of overwriting the short message pattern--> %ex{short}%.100m <!-- Use HTML output of the full message. Yes, any layout can be used (please don't actually do this)--> %d{MM-dd HH:mm:ss.SSS} [%thread] %-5level \(%F:%L\) - %msg %n true true true true requestId:long <!--Facility is not officially supported in GELF anymore, but you can use staticFields to do the same thing--> tag business-server ``` ## 系统使用 功能菜单说明 - search 日志查询面板  - streams 将日志对象按照filed定义为stream，默认的stream为all messages  - alerts 告警相关，选择一个stream对象定义告警条件和通知方式，当stream里面的日志满足条件时候告警并通知  - dashboards 图形面板  - source 告警所在主机  - system 系统配置  ### 查询条件 [官方说明文档](http://docs.graylog.org/en/3.0/pages/queries.html) > 关键字不分大小写 - 单个关键字查询 `ssh` - 多关键字查询,含有ssh or login `ssh login` - 含有某个字符串查询 `ssh login` - 同时含有多个关键字查询 `opening index" AND db` - 根据字段值查询 `tag:couchdb.peer0.org1.ygsoft.com` - 含有多个tag的查询，某条记录只要其中一个字段满足即可 ``` tag: (orderer.ygsoft.com couchdb.peer0.org1.ygsoft.com) or tag: orderer.ygsoft.com couchdb.peer0.org1.ygsoft.com ``` - 含有完全匹配字段 `tag:"ssh login"` - 含有某个字段的记录: `_exists_:tag` - 不含有某个字段的记录: `NOT _exists_:tag` - AND OR `"ssh login" AND source:example.org` `("ssh login" AND (source:example.org OR source:another.example.org)) OR _exists_:always_find_me` - NOT ``` "ssh login" AND NOT source:example.org NOT example.org ``` 注意： AND, OR, and NOT 只能大写. - 通配符 ? 表示单个字符 星号表示0个和多个字符 ``` source:*.org source:exam?le.org source:exam?le.* ``` 注意：默认首字母不能使用通配符，因为这样会使用大量的内存；强行开启修改配置文件`allow_leading_wildcard_searches = true` - 当某关键字不确认顺序的时候使用~ ``` ssh logni~ source:exmaple.org~ 结果可以匹配 ssh login and example.org ``` - 以下字符在使用的时候必须用反斜杠转义 ``` && || : \ / + - ! ( ) { } [ ] ^ " ~ * ? Example: resource:\/posts\/45326 ``` ### 查询条件可以保存下来 使用 save search criteria 按钮

我们已经在运行Graylog服务器，并且我们将开始准备地形以捕获这些日志记录。 指标 该过程类似于我们对zimbra或鱿鱼所做的过程。 现在，我们在系统/索引中创建Pfsense索引 索引分片4和索引副本0，可以删除索引时间...