日志收集与分析系统操作

1
cat > docker-compose.yml <<'EOF'
2
version: '3.8'
3

4
services:
5
  loki:
6
    image: grafana/loki:2.9.4
7
    container_name: loki
8
    ports:
9
      - "3100:3100"
10
    volumes:
11
      - ./loki-config.yml:/etc/loki/local-config.yaml
12
      - loki-data:/loki
13
    command: -config.file=/etc/loki/local-config.yaml
14
    restart: unless-stopped
15
    networks:
16
      - loki-network
17
    healthcheck:
18
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3100/ready || exit 1"]
19
      interval: 10s
20
      timeout: 5s
21
      retries: 5
22

23
  grafana:
24
    image: grafana/grafana:10.3.1
25
    container_name: grafana
26
    ports:
27
      - "3000:3000"
28
    environment:
29
      - GF_SECURITY_ADMIN_USER=admin
30
      - GF_SECURITY_ADMIN_PASSWORD=admin123
31
      - GF_USERS_ALLOW_SIGN_UP=false
32
    volumes:
33
      - grafana-data:/var/lib/grafana
34
      - ./grafana-provisioning:/etc/grafana/provisioning
35
    restart: unless-stopped
36
    networks:
37
      - loki-network
38
    depends_on:
39
      loki:
40
        condition: service_healthy
41

42
  promtail:
43
    image: grafana/promtail:2.9.4
44
    container_name: promtail
45
    volumes:
46
      - /var/log/journal:/var/log/journal:ro
47
      - /run/log/journal:/run/log/journal:ro
48
      - /etc/machine-id:/etc/machine-id:ro
49
      - ./promtail-config.yml:/etc/promtail/config.yml
50
    command: -config.file=/etc/promtail/config.yml
51
    restart: unless-stopped
52
    networks:
53
      - loki-network
54
    depends_on:
55
      - loki
56

57
networks:
58
  loki-network:
59
    driver: bridge
60

61
volumes:
62
  grafana-data:
63
  loki-data:
64
EOF

1
cat > loki-config.yml <<'EOF'
2
auth_enabled: false
3

4
server:
5
  http_listen_port: 3100
6
  grpc_listen_port: 9095
7

8
common:
9
  path_prefix: /loki
10
  storage:
11
    filesystem:
12
      chunks_directory: /loki/chunks
13
      rules_directory: /loki/rules
14
  replication_factor: 1
15
  ring:
16
    kvstore:
17
      store: inmemory
18

19
ingester:
20
  lifecycler:
21
    ring:
22
      kvstore:
23
        store: inmemory
24
      replication_factor: 1
25
  chunk_idle_period: 5m
26
  chunk_retain_period: 30s
27
  wal:
28
    dir: /loki/wal
29

30
schema_config:
31
  configs:
32
    - from: 2020-10-24
33
      store: boltdb-shipper
34
      object_store: filesystem
35
      schema: v11
36
      index:
37
        prefix: index_
38
        period: 24h
39

40
storage_config:
41
  boltdb_shipper:
42
    active_index_directory: /loki/boltdb-shipper-active
43
    cache_location: /loki/boltdb-shipper-cache
44
    cache_ttl: 24h
45
    shared_store: filesystem
46
  filesystem:
47
    directory: /loki/chunks
48

49
compactor:
50
  working_directory: /loki/boltdb-shipper-compactor
51
  shared_store: filesystem
52

53
limits_config:
54
  reject_old_samples: true
55
  reject_old_samples_max_age: 168h
56
  ingestion_rate_mb: 16
57
  ingestion_burst_size_mb: 32
58

59
chunk_store_config:
60
  max_look_back_period: 0s
61

62
table_manager:
63
  retention_deletes_enabled: false
64
  retention_period: 0s
65
EOF

1
cat > promtail-config.yml <<'EOF'
2
server:
3
  http_listen_port: 9080
4
  grpc_listen_port: 0
5

6
positions:
7
  filename: /tmp/positions.yaml
8

9
clients:
10
  - url: http://loki:3100/loki/api/v1/push
11

12
scrape_configs:
13
  - job_name: journal
14
    journal:
15
      max_age: 12h
16
      labels:
17
        job: systemd-journal
18
        host: kali-linux
19
    relabel_configs:
20
      - source_labels: ['__journal__systemd_unit']
21
        target_label: 'unit'
22
      - source_labels: ['__journal__hostname']
23
        target_label: 'hostname'
24
      - source_labels: ['__journal__transport']
25
        target_label: 'transport'
26
      - source_labels: ['__journal_priority_keyword']
27
        target_label: 'level'
28
EOF

1
cat > grafana-provisioning/datasources/loki.yml <<'EOF'
2
apiVersion: 1
3

4
datasources:
5
  - name: Loki
6
    type: loki
7
    access: proxy
8
    url: http://loki:3100
9
    isDefault: true
10
    editable: false
11
    jsonData:
12
      maxLines: 1000
13
      derivedFields:
14
        - name: "IP Address"
15
          matcherRegex: "from\\s+(\\d+\\.\\d+\\.\\d+\\.\\d+)"
16
          url: "$${__value.raw}"
17
EOF