汇总-13台虚拟机搭建一个高可用负载均衡集群架构 验收

要求

用13台虚拟机搭建一个高可用负载均衡集群架构出来,并运行三个站点,具体需求如下。

  1. 设计你认为合理的架构,用visio把架构图画出来

  2. 搭建lnmp、tomcat+jdk环境

  3. 三个站点分别为:discuz论坛、dedecms企业网站以及zrlog博客

  4. 由于机器有限,尽可能地把三个站点放到同一台服务器上,然后做负载均衡集群,要求所有站点域名解析到一个ip上,也就是说只有一个出口ip

  5. 需要共享静态文件,比如discuz需要共享的目录是 data/attachment,dedecms需要共享upload(具体目录,你可以先上传一个图片,查看图片所在目录)

  6. 设计合理的目录、文件权限,比如discuz的data目录需要给php-fpm进程用户可写权限,其他目录不用写的就不要给写权限(目录755,文件644,属主属组root)

  7. 所有服务器要求只能普通用户登录,而且只能密钥登录,root只能普通用户sudo

  8. 给所有服务器做一个简单的命令审计功能

  9. php-fpm服务要求设置慢执行日志,超时时间为2s,并做日志切割,日志保留一月

  10. 所有站点都需要配置访问日志,并做日志切割,要求静态文件日志不做记录,日志保留一月

  11. 制定合理的mysql数据备份方案,并写备份脚本,要求把备份数据传输到备份服务器

  12. 制定代码、静态文件的备份方案,并写备份脚本,要求把备份数据传输到备份服务器

  13. 编写数据恢复文档,能保证当数据丢失在2小时内恢复所有数据

  14. 搭建zabbix监控告警系统,要求监控各个基础指标(cpu、内存、硬盘),网卡流量需要成图,还需要监控web站点的可用性,

  15. 定制自定义监控脚本,监控web服务器的并发连接数,接入zabbix,成图,设置触发器,超过100告警

  16. 定制自定义监控脚本,监控mysql的队列,接入zabbix,成图,设置触发器,队列超过300告警

  17. 定制自定义监控脚本,监控mysql的慢查询日志,接入zabbix,成图,设置触发器,每分钟超过60条日志需要告警,需要仔细分析慢查询日志的规律,确定日志条数

  18. 利用jmx,在zabbix上监控tomcat

  19. 给三个站点的后台访问做二次认证,增加安全性

  20. 用shell脚本实现文件、代码同步上线(参考分发系统)

IP实际分配

在这里插入图片描述

架构图

  • 架构调整后没有使用数据库中间件,因为网站程序不能实现读写分离;
  • 实验过程分别使用mycat和atlas实现了读写分离;
  • 网站只对接一台主数据库服务器,但是这个服务还是跟另外一台服务器主主同步,另有一台从机与二主数据库同步;
  • 由于阿里云不能使用VIP,所以都没有实现高可用;
    在这里插入图片描述

设置记录

  • 负载均衡
upstream yuankeedu_com
    {
#        ip_hash;
        server 172.31.215.150:80; #服务器IP与端口;
	server 172.31.215.148:80;
	server 172.31.215.149:80;
    }
upstream zrlog_com
    {
#        ip_hash;
        server 172.31.215.150:8080; #服务器IP与端口;
        server 172.31.215.148:8080; #服务器IP与端口;
        server 172.31.215.149:8080; #服务器IP与端口;

   }

server {
        server_name  bbs.yuankeedu.com;
  listen       80 ;
 listen       [::]:80;
 location /
        {
            proxy_pass http://yuankeedu_com;   #upstream
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }
server {

  server_name blog.yuankeedu.com; 
 listen       80 ;
        listen       [::]:80;
location /
        {
            proxy_pass http://zrlog_com;                    #upstream
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    } 

server {
        server_name  www.yuankeedu.com;
  listen       80 ;
        listen       [::]:80;
    location /
        {
            proxy_pass http://yuankeedu_com;                    #upstream
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
 }
  • 其中一台web的nginx配置,三台都一样
discuz论坛
server {
        server_name  bbs.yuankeedu.com;
 listen       80 ;
        listen       [::]:80;
        root         /data/wwwroot/bbs.yuankeedu.com;
 index  index.html index.htm index.php;
        # Load configuration files for the default server block.
       include /etc/nginx/default.d/*.conf;

        location ~ /admin.php\?$ {
	auth_basic "User Authentication";     
       	auth_basic_user_file /data/wwwroot/bbs.yuankedu.com/data/attachment/user_pw;  
	fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /data/wwwroot/bbs.yuankeedu.com$fastcgi_script_name;
        include        fastcgi_params;
	}

	location ~ \.php$ {
 root           /data/wwwroot/bbs.yuankeedu.com;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /data/wwwroot/bbs.yuankeedu.com$fastcgi_script_name;
        include        fastcgi_params;
        }
	
	location ~* \.(png|jpeg|gif|js|css|bmp|flv)$ {
	access_log off;
}    

access_log  /data/logs/bbs.access.log  main;
	location /nginx_status 
{
        stub_status on;		#主要语句;
        access_log   off;
        allow 127.0.0.1;
        deny all;
    }
}

dedecms网站
server {
        server_name  www.yuankeedu.com;
 listen       80 ;
        listen       [::]:80;
        root         /data/wwwroot/www.yuankeedu.com;
        index           index.html index.htm index.php;
        # Load configuration files for the default server block.
	
	location ~ /dede/$ {
        auth_basic "User Authentication";
        auth_basic_user_file /data/wwwroot/www.yuankeedu.com/uploads/user_pw;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /data/wwwroot/www.yuankeedu.com$fastcgi_script_name;
        include        fastcgi_params;
        }
	
        location ~ \.php$ {
        root           /data/wwwroot/www.yuankeedu.com;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /data/wwwroot/www.yuankeedu.com$fastcgi_script_name;
        include        fastcgi_params;
        }

	location ~* \.(png|jpeg|gif|js|css|bmp|flv)$ {
        access_log off;
}

	access_log  /data/logs/www.access.log  main;    

	location /nginx_status 
{
        stub_status on;		#主要语句;
        access_log   off;
        allow 127.0.0.1;
        deny all;
    }
}

  • 其中一台服务器论坛设置的数据库信息:
    只对接到主数据库上,三个库为discuz3, dedecms3, zrlog3
$_config['db']['1']['dbhost'] = '172.31.215.153';
$_config['db']['1']['dbuser'] = 'discuz3';
$_config['db']['1']['dbpw'] = 'discuz3';
$_config['db']['1']['dbcharset'] = 'utf8';
$_config['db']['1']['pconnect'] = '0';
$_config['db']['1']['dbname'] = 'discuz3';
$_config['db']['1']['tablepre'] = 'pre_';
$_config['db']['slave'] = '';
$_config['db']['common']['slave_except_table'] = '';

  • 目录权限
discuz需要写权限的目录和修改命令
chown -R php-fpm config data uc_server/data uc_client/data
dedecms需要写权限的目录和修改命令
chown -R php-fpm plus dede data a install special uploads
  • 数据库授权命令
grant all on discuz3.* to 'discuz3'@'172.31.215.148' identified by 'discuz3';
grant all on discuz3.* to 'discuz3'@'172.31.215.149' identified by 'discuz3';
grant all on discuz3.* to 'discuz3'@'172.31.215.150' identified by 'discuz3';
grant all on dedecms3.* to 'dedecms3'@'172.31.215.148' identified by 'dedecms3';
grant all on dedecms3.* to 'dedecms3'@'172.31.215.149' identified by 'dedecms3';
grant all on dedecms3.* to 'dedecms3'@'172.31.215.150' identified by 'dedecms3';
grant all on zrlog3.* to 'zrlog3'@'172.31.215.148' identified by 'zrlog3';
grant all on zrlog3.* to 'zrlog3'@'172.31.215.149' identified by 'zrlog3';
grant all on zrlog3.* to 'zrlog3'@'172.31.215.150' identified by 'zrlog3';

环境测试

  • 以两个php网站为例,zrlog使用java还不懂相关测试方法;
  • 是否实现了三个web服务器的负载均衡
    创建了一个test页面用于显示当前的web服务器IP,负载均衡使用轮询方式
bbs站点discuz
TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 bbs.yuankeedu.com/test.php
Host: bbs.yuankeedu.com
Remote Address: 172.31.215.159
X-Forwarded-For: 219.137.190.111
X-Forwarded-Proto: 
Server Address: 172.31.215.150
Server Port: 80

TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 bbs.yuankeedu.com/test.php
Host: bbs.yuankeedu.com
Remote Address: 172.31.215.159
X-Forwarded-For: 219.137.190.111
X-Forwarded-Proto: 
Server Address: 172.31.215.148
Server Port: 80

TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 bbs.yuankeedu.com/test.php
Host: bbs.yuankeedu.com
Remote Address: 172.31.215.159
X-Forwarded-For: 219.137.190.111
X-Forwarded-Proto: 
Server Address: 172.31.215.149
Server Port: 80

www站点dedecms
TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 www.yuankeedu.com/test.php
Host: www.yuankeedu.com
Remote Address: 172.31.215.159
X-Forwarded-For: 219.137.190.111
X-Forwarded-Proto: 
Server Address: 172.31.215.150
Server Port: 80

TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 www.yuankeedu.com/test.php
Host: www.yuankeedu.com
Remote Address: 172.31.215.159
X-Forwarded-For: 219.137.190.111
X-Forwarded-Proto: 
Server Address: 172.31.215.148
Server Port: 80

TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 www.yuankeedu.com/test.php
Host: www.yuankeedu.com
Remote Address: 172.31.215.159
X-Forwarded-For: 219.137.190.111
X-Forwarded-Proto: 
Server Address: 172.31.215.149
Server Port: 80

页面显示正常
在这里插入图片描述

在这里插入图片描述

在这里插入图片描述

数据库

主数据库
mysql> show master status;
+---------------+----------+-------------------------+------------------+-------------------+
| File          | Position | Binlog_Do_DB            | Binlog_Ignore_DB | Executed_Gtid_Set |
+---------------+----------+-------------------------+------------------+-------------------+
| master.000009 |    79485 | discuz3,dedecms3,zrlog3 |                  |                   |
+---------------+----------+-------------------------+------------------+-------------------+
1 row in set (0.00 sec)
主数据库是二主的从机
mysql> show slave status \G
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.31.215.154
                  Master_User: repli
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: second.000012
          Read_Master_Log_Pos: 75038
               Relay_Log_File: ape-test3005-relay-bin.000010
                Relay_Log_Pos: 361
        Relay_Master_Log_File: second.000012
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes
              Replicate_Do_DB: 
          Replicate_Ignore_DB: 
           Replicate_Do_Table: 
       Replicate_Ignore_Table: 
      Replicate_Wild_Do_Table: 
  Replicate_Wild_Ignore_Table: 
                   Last_Errno: 0
                   Last_Error: 
                 Skip_Counter: 0
          Exec_Master_Log_Pos: 75038
              Relay_Log_Space: 738
              Until_Condition: None
               Until_Log_File: 
                Until_Log_Pos: 0
           Master_SSL_Allowed: No
           Master_SSL_CA_File: 
           Master_SSL_CA_Path: 
              Master_SSL_Cert: 
            Master_SSL_Cipher: 
               Master_SSL_Key: 
        Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
                Last_IO_Errno: 0
                Last_IO_Error: 
               Last_SQL_Errno: 0
               Last_SQL_Error: 
  Replicate_Ignore_Server_Ids: 
             Master_Server_Id: 101
                  Master_UUID: e825cd46-1675-11ea-9a82-00163e0a0167
             Master_Info_File: /data/mysql/master.info
                    SQL_Delay: 0
          SQL_Remaining_Delay: NULL
      Slave_SQL_Running_State: Slave has read all relay log; waiting for more updates
           Master_Retry_Count: 86400
                  Master_Bind: 
      Last_IO_Error_Timestamp: 
     Last_SQL_Error_Timestamp: 
               Master_SSL_Crl: 
           Master_SSL_Crlpath: 
           Retrieved_Gtid_Set: 
            Executed_Gtid_Set: 
                Auto_Position: 0
         Replicate_Rewrite_DB: 
                 Channel_Name: 
           Master_TLS_Version: 
1 row in set (0.00 sec)
二主是一主的主机
mysql> show master status;
+---------------+----------+-------------------------+------------------+-------------------+
| File          | Position | Binlog_Do_DB            | Binlog_Ignore_DB | Executed_Gtid_Set |
+---------------+----------+-------------------------+------------------+-------------------+
| second.000012 |    75038 | discuz3,dedecms3,zrlog3 |                  |                   |
+---------------+----------+-------------------------+------------------+-------------------+
1 row in set (0.00 sec)

二主是一主的从机

mysql> show slave status \G
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.31.215.153
                  Master_User: repli
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: master.000009
          Read_Master_Log_Pos: 79485
               Relay_Log_File: ape-test3010-relay-bin.000012
                Relay_Log_Pos: 79692
        Relay_Master_Log_File: master.000009
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes
              Replicate_Do_DB: 
          Replicate_Ignore_DB: 
           Replicate_Do_Table: 
       Replicate_Ignore_Table: 
      Replicate_Wild_Do_Table: 
  Replicate_Wild_Ignore_Table: 
                   Last_Errno: 0
                   Last_Error: 
                 Skip_Counter: 0
          Exec_Master_Log_Pos: 79485
              Relay_Log_Space: 80069
              Until_Condition: None
               Until_Log_File: 
                Until_Log_Pos: 0
           Master_SSL_Allowed: No
           Master_SSL_CA_File: 
           Master_SSL_CA_Path: 
              Master_SSL_Cert: 
            Master_SSL_Cipher: 
               Master_SSL_Key: 
        Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
                Last_IO_Errno: 0
                Last_IO_Error: 
               Last_SQL_Errno: 0
               Last_SQL_Error: 
  Replicate_Ignore_Server_Ids: 
             Master_Server_Id: 100
                  Master_UUID: 19142ad4-1510-11ea-b1b6-00163e042516
             Master_Info_File: /data/mysql/master.info
                    SQL_Delay: 0
          SQL_Remaining_Delay: NULL
      Slave_SQL_Running_State: Slave has read all relay log; waiting for more updates
           Master_Retry_Count: 86400
                  Master_Bind: 
      Last_IO_Error_Timestamp: 
     Last_SQL_Error_Timestamp: 
               Master_SSL_Crl: 
           Master_SSL_Crlpath: 
           Retrieved_Gtid_Set: 
            Executed_Gtid_Set: 
                Auto_Position: 0
         Replicate_Rewrite_DB: 
                 Channel_Name: 
           Master_TLS_Version: 
1 row in set (0.00 sec)

二主是从机的主机
mysql> show slave status \G
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.31.215.154
                  Master_User: repli
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: second.000012
          Read_Master_Log_Pos: 75038
               Relay_Log_File: slaver.000007
                Relay_Log_Pos: 75245
        Relay_Master_Log_File: second.000012
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes
              Replicate_Do_DB: 
          Replicate_Ignore_DB: 
           Replicate_Do_Table: 
       Replicate_Ignore_Table: 
      Replicate_Wild_Do_Table: 
  Replicate_Wild_Ignore_Table: 
                   Last_Errno: 0
                   Last_Error: 
                 Skip_Counter: 0
          Exec_Master_Log_Pos: 75038
              Relay_Log_Space: 75606
              Until_Condition: None
               Until_Log_File: 
                Until_Log_Pos: 0
           Master_SSL_Allowed: No
           Master_SSL_CA_File: 
           Master_SSL_CA_Path: 
              Master_SSL_Cert: 
            Master_SSL_Cipher: 
               Master_SSL_Key: 
        Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
                Last_IO_Errno: 0
                Last_IO_Error: 
               Last_SQL_Errno: 0
               Last_SQL_Error: 
  Replicate_Ignore_Server_Ids: 
             Master_Server_Id: 101
                  Master_UUID: e825cd46-1675-11ea-9a82-00163e0a0167
             Master_Info_File: /data/mysql/master.info
                    SQL_Delay: 0
          SQL_Remaining_Delay: NULL
      Slave_SQL_Running_State: Slave has read all relay log; waiting for more updates
           Master_Retry_Count: 86400
                  Master_Bind: 
      Last_IO_Error_Timestamp: 
     Last_SQL_Error_Timestamp: 
               Master_SSL_Crl: 
           Master_SSL_Crlpath: 
           Retrieved_Gtid_Set: 
            Executed_Gtid_Set: 
                Auto_Position: 0
         Replicate_Rewrite_DB: 
                 Channel_Name: 
           Master_TLS_Version: 
1 row in set (0.00 sec)

数据库同步测试

在主机上创建库;
mysql> use discuz3;
mysql> create table zz(id int,name varchar(20));

mysql> show tables;
三个库都显示如下库,证明写入可以同步到三台数据库上;
zz  

使用单独mycat机器测试读写分离
discuz3逻辑库对应于三台数据库的discuz3库;

从机数据库删除刚刚创建的库;
mysql> drop table zz;
登陆mycat;
mysql -uroot -ppassword -h127.0.0.1 -P8066
mysql> show tables;  
结果依家出现有zz表,没有zz表两种结果,因为二主跟从机只支持读,而从机已经删掉了zz表;

从机再新建zz表;必须要新建库,之后的删除命令不成功的话,会造成同步失败;
mysql> create table zz(id int,name varchar(20));

在mycat里删除zz表;
mysql> drop table zz;
三台数据库单独再查看tables,table zz都没有了,证明写同步了;
mysql> show tables;  


使用atlas测试读写分离,方法一样,以下是启动命令
 /usr/local/mysql-proxy/bin/mysql-proxyd test start
 mysql -uatlas -patlas -h127.0.0.1 -P3306
 默认的工作端口1234改成了3306
 atlas帐号可以连接到三台数据库的库中;
  • mycat管理界面看后台情况

在这里插入图片描述
在这里插入图片描述

  • Atlas配置文件记录
[mysql-proxy]
admin-username = user
admin-password = pwd
proxy-backend-addresses = 172.31.215.153:3306
proxy-read-only-backend-addresses = 172.31.215.154:3306@1, 172.31.215.155:3306@1
pwds = atlas:KsWNCR6qyNk=, test:A1YaJzZgEjM=
daemon = true
keepalive = true
event-threads = 8
log-level = message
log-path = /usr/local/mysql-proxy/log
proxy-address = 0.0.0.0:3306
admin-address = 0.0.0.0:2345
  • mycat 配置文件记录
vim /usr/local/mycat/conf/server.xml
...上面略
 <user name="root">
                <property name="password">password</property>
                <property name="schemas">discuz3,dedecms3,zrlog3</property>
        </user>
        <user name="discuz3">
                <property name="password">discuz3</property>
                <property name="schemas">discuz3</property>
        </user>
        <user name="dedecms3">
                <property name="password">dedecms3</property>
                <property name="schemas">dedecms3</property>
        </user>
        <user name="zrlog3">
                <property name="password">zrlog3</property>
                <property name="schemas">zrlog3</property>
        </user>
        <user name="user">
                <property name="password">user</property>
                <property name="schemas">discuz3,dedecms3,zrlog3</property>
                <property name="readOnly">true</property>
        </user>

</mycat:server>

cat /usr/local/mycat/conf/schema.xml

<?xml version="1.0"?>
<!DOCTYPE mycat:schema SYSTEM "schema.dtd">
<mycat:schema xmlns:mycat="http://io.mycat/">
        <schema name="discuz3" checkSQLschema="false" sqlMaxLimit="1000" dataNode="dn1" />
        <schema name="dedecms3" checkSQLschema="false" sqlMaxLimit="1000" dataNode="dn2" />
        <schema name="zrlog3" checkSQLschema="false" sqlMaxLimit="1000" dataNode="dn3" />

        <dataNode name="dn1" dataHost="localhost1" database="discuz3" />
        <dataNode name="dn2" dataHost="localhost1" database="dedecms3" />
        <dataNode name="dn3" dataHost="localhost1" database="zrlog3" />
        <dataHost name="localhost1" maxCon="2000" minCon="1" balance="3"
                          writeType="1" dbType="mysql" dbDriver="native" switchType="-1"  slaveThreshold="100">
            <heartbeat>select user()</heartbeat>

            <writeHost host="hostM1" url="172.31.215.153:3306" user="root" password="password">
                  <!-- can have multi read hosts -->
                  <readHost host="hostS1" url="172.31.215.154:3306" user="root" password="password" />
                  <readHost host="hostS2" url="172.31.215.155:3306" user="root" password="password" />
            </writeHost>
        </dataHost>
</mycat:schema>

静态文件共享

  • 安装nfs-util
  • 创建目录,修改权限
  • 修改配置文件
  • 创建nfs用户
  • 直接查看配置文件
[root@ape-test3007 ~]# cat /etc/exports
/data/discuz 172.31.215.0/24(rw,sync,root_squash,anonuid=1000,anongid=1000)
/data/dedecms 172.31.215.0/24(rw,sync,root_squash,anonuid=1000,anongid=1000)
/data/zrlog 172.31.215.0/24(rw,sync,root_squash,anonuid=1000,anongid=1000)

[root@ape-test3007 ~]# ls -ld /data/*
drwxrwxrwx  8 root root 4096 12月  8 10:58 /data/dedecms
drwxrwxrwx 11 root root 4096 12月  8 10:56 /data/discuz
drwxrwxrwx  2 root root 4096 12月  7 23:26 /data/zrlog

[root@ape-test3007 ~]# ll /data/discuz/
总用量 40
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:22 album
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:21 category
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:21 common
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:22 forum
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:22 group
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:21 portal
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:21 profile
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:21 swfupload
drwxr-xr-x 2 nfs  nfs  4096 12月  7 20:21 temp
-rw-r--r-- 1 root root   88 12月  8 10:56 user_pw
  • 三台web服务器需要安装nfs-util,使用静态文件的目录挂载nfs的共享目录,以让静态文件都通过nfs同步到三台服务器
  • 其中一个台web服务器的自动挂载配置
    zrlog的目录要新建,没有上传文件之前并不存在;
    discuz要备份目录结构再挂载,挂载后把备份内容放回到nfs服务器里;
[root@ape-test3001 ~]# cat !$
cat /etc/fstab

#
# /etc/fstab
# Created by anaconda on Tue Oct  8 09:13:42 2019
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
UUID=87ba1103-a0d7-49ef-a8ae-6ce1d3fd2453 /                       ext4    defaults        1 1
172.31.215.156:/data/discuz /data/wwwroot/bbs.yuankeedu.com/data/attachment nfs  defaults 0  0
172.31.215.156:/data/dedecms /data/wwwroot/www.yuankeedu.com/uploads   nfs  defaults 0 0
172.31.215.156:/data/zrlog /usr/local/tomcat/webapps/ROOT/attached   nfs   defaults 0   0

手动umount一个挂载后
mount -a会把配置文件里的设置都挂载上

只使用普通用户ssh登陆,再授权su -

  • 以一台机器为例 用户名tanytan
    在公网机和内网机上分别创建用户tanytan
这是带公网的机器,所有登陆必须通过这台机器,公网机器跟内网机器都需要新增普通用户;

[root@ape-test3000 ~]# useradd tanytan
[root@ape-test3000 ~]# passwd tanytan
更改用户 tanytan 的密码 。
新的 密码:
无效的密码: 密码未通过字典检查 - 它基于字典单词
重新输入新的 密码:
passwd:所有的身份验证令牌已经成功更新。

[root@ape-test3008 ~]# useradd tanytan
[root@ape-test3008 ~]# passwd tanytan
更改用户 tanytan 的密码 。
新的 密码:
无效的密码: 密码未通过字典检查 - 它基于字典单词
重新输入新的 密码:
passwd:所有的身份验证令牌已经成功更新。

把使用机器的密钥先上传到公网机器上

TanydeMacBook-Air:~ tanytan$ ssh-copy-id 47.105.218.25
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/tanytan/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
tanytan@47.105.218.25's password: 
Permission denied, please try again.
tanytan@47.105.218.25's password: 

Number of key(s) added:        1

Now try logging into the machine, with:   "ssh '47.105.218.25'"
and check to make sure that only the key(s) you wanted were added.

即可免密登陆公网机器

TanydeMacBook-Air:~ tanytan$ ssh 47.105.218.25
Last failed login: Sun Dec  8 12:31:53 CST 2019 from 219.137.190.111 on ssh:notty
There was 1 failed login attempt since the last successful login.

Welcome to Alibaba Cloud Elastic Compute Service !

[tanytan@ape-test3000 ~]$

在公网机上为当前用户新增密钥

[tanytan@ape-test3000 ~]$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/home/tanytan/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/tanytan/.ssh/id_rsa.
Your public key has been saved in /home/tanytan/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:qZRnvYPe0ki14KTekZjv2CpGIKQkmhOkfCWsYEs3kW4 tanytan@ape-test3000
The key's randomart image is:
+---[RSA 2048]----+
|...oo.           |
|*= =o            |
|@+=..            |
|*ooE   .oo.      |
| o..  o*S+..     |
|    ..++=...     |
|   . ..+.+o      |
|    o .+=...     |
|   . .oo+..      |
+----[SHA256]-----+

把密钥文件上传到要访问的内网机器上(已建立对应普通用户名)
[tanytan@ape-test3000 ~]$ ssh-copy-id 172.31.215.147
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/tanytan/.ssh/id_rsa.pub"
The authenticity of host '172.31.215.147 (172.31.215.147)' can't be established.
ECDSA key fingerprint is SHA256:DsbelDqGedZIZ5DsKFpynnbUF3GiDiysNz/FBtbAQ68.
ECDSA key fingerprint is MD5:e2:55:a9:8a:cb:e2:59:79:26:6a:75:27:d5:23:11:78.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
tanytan@172.31.215.147's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '172.31.215.147'"
and check to make sure that only the key(s) you wanted were added.

即可免密登陆到内网机器上
[tanytan@ape-test3000 ~]$ ssh 172.31.215.147

Welcome to Alibaba Cloud Elastic Compute Service !
[tanytan@ape-test3008 ~]$ 

设置此普通用户的sudo权限

[root@ape-test3008 ~]# visudo
增加一句;
root    ALL=(ALL)       ALL
tanytan ALL=(ALL)       NOPASSWD: /usr/bin/su
[root@ape-test3008 ~]# su tanytan
[tanytan@ape-test3008 root]$ sudo su
可以无密码转到root帐号下;
[root@ape-test3008 ~]# 

设置只能密钥登陆和root用户不能ssh登陆

vi /etc/ssh/sshd_config
设置以下两个选项
PasswordAuthentication no
PermitRootLogin no   #root不能使用密钥和密码登陆;

[root@ape-test3000 ~]# ssh 172.31.215.147
使用root密钥不能登陆
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

[tanytan@ape-test3000 .ssh]$ mv id_rsa id_rsa.bak
没有私钥后,不能登陆机器;
[tanytan@ape-test3000 .ssh]$ ssh 172.31.215.147
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

修改PasswordAuthentication yes后,可以使用密码登陆;

命令记录

vi /etc/profile #在最后加入以下内容;

  • 由于加入到/etc/profile等于以root权限运行下面句子,普通用户加载这个句子是不能成功运行的,所以只是记录了以root权限使用机器的命令;
if [ ! -d  /usr/local/domob/records/${LOGNAME} ]

then

mkdir -p /usr/local/domob/records/${LOGNAME}

chmod 300 /usr/local/domob/records/${LOGNAME}

fi

export HISTORY_FILE="/usr/local/domob/records/${LOGNAME}/bash_history"

export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'


source /etc/profile

web nginx日志切割

/var/log/nginx/*.log /data/logs/bbs.access.log /data/logs/www.access.log  {
        daily
        dateext
        missingok
        rotate 30
        compress
        delaycompress
        notifempty
        create 640 nginx adm
        sharedscripts
        postrotate
                if [ -f /var/run/nginx.pid ]; then
                        kill -USR1 `cat /var/run/nginx.pid`
                fi
        endscript
}

/usr/local/tomcat/logs/catalina.out {  
 copytruncate  #创建复制文件,然后清空原文件;
 daily  
 dateext  
 nocompress  
 missingok  
}

php慢查询日志

[root@ape-test3001 ~]# vim /usr/local/php-fpm/etc/php-fpm.d/www.conf 
修改相应句子;
slowlog = /tmp/php.slow
request_slowlog_timeout = 2

[root@ape-test3001 ~]# vim /tmp/php.slow 
使用sleep()语句测试时,记录的结果;

[04-Dec-2019 14:50:05]  [pool www] pid 21852
script_filename = /data/wwwroot/bbs.yuankeedu.com/test.php
[0x00007f343641f220] sleep() /data/wwwroot/bbs.yuankeedu.com/test.php:9

[04-Dec-2019 14:50:17]  [pool www] pid 21853
script_filename = /data/wwwroot/bbs.yuankeedu.com/test.php
[0x00007f343641f220] sleep() /data/wwwroot/bbs.yuankeedu.com/test.php:9


logrotate配置:
/tmp/php.slow {
daily
dateext
missingok
rotate 30
create 640 php-fpm php-fpm
sharedscripts
postrotate
  if [ -f /usr/local/php-fpm/var/run/php-fpm.pid ]; then
  kill -USR1 `cat /usr/local/php-fpm/var/run/php-fpm.pid`   #发送重新加载的信号;
  fi
endscript
}

nginx站点访问日志

  • 日志设置在前面有具体样板
  • 日志记录情况如下:
172.31.215.159 - user1 [08/Dec/2019:11:49:51 +0800] "GET /uc_server/avatar.php?uid=1&size=small&ts=1 HTTP/1.0" 302 0 "http://bbs.yuankeedu.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15" "219.137.190.111"
172.31.215.159 - user1 [08/Dec/2019:11:49:51 +0800] "GET /home.php?mod=spacecp&ac=pm&op=checknewpm&rand=1575776990 HTTP/1.0" 200 0 "http://bbs.yuankeedu.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15" "219.137.190.111"

三个站点后台的二次认证

  • 站点登陆后台成功后的地址为
http://bbs.yuankeedu.com/admin.php?
http://www.yuankeedu.com/dede/index.php
  • 以这个链接做二次认证,具体如上面所示

  • 二次认证可能记住了访问地址,成功登陆过以后就不再显示认证窗口

  • 认证密码文件也共享在nfs服务器上

  • zrlog密码认证暂时忽略

  • 测试例子

TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 www.yuankeedu.com/dede/ -I
HTTP/1.1 401 Unauthorized
Server: nginx/1.16.1
Date: Sun, 08 Dec 2019 13:16:08 GMT
Content-Type: text/html
Content-Length: 179
Connection: keep-alive
WWW-Authenticate: Basic realm="User Authentication"

TanydeMacBook-Air:~ tanytan$ curl -x47.105.218.25:80 www.yuankeedu.com/dede/ -uuser1:password -I
HTTP/1.1 302 Found
Server: nginx/1.16.1
Date: Sun, 08 Dec 2019 13:16:29 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/7.3.0
Set-Cookie: PHPSESSID=ebego126eg6a3vkcmspumh72ij; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Cache-Control: private
Set-Cookie: _csrf_name_bda4f76f=ca5858325e89e4e48fbe19dd7f5318bd; expires=Sun, 08-Dec-2019 15:16:29 GMT; Max-Age=7200; path=/
Set-Cookie: _csrf_name_bda4f76f__ckMd5=dd1a785e4e07e248; expires=Sun, 08-Dec-2019 15:16:29 GMT; Max-Age=7200; path=/
location: login.php?gotopage=%2Fdede%2F

数据库备份方案

  • 每天备份二主数据库,在任务计划里执行脚本,本地保存7天的备份
  • 把备份文件同步一份到备份服务器,服务器保留一个月
  • 每天把前天的文件压缩
  • 每天把七天前的文件删除
二主数据库和备份服务器都要有一个普通的备份帐号
此帐号在二主数据库上需要实现无密码登陆备份服务器 

生成本地备份目录
mkdir -p /data/backup
chown -R tanytan /data/backup

备份服务器目录
mkdir -p /data/backup
chown -R tanytan /data/backup

二主数据库,授权备份用户
grant all on discuz3.* to 'dumper'@'localhost' identified by 'password';
grant all on dedecms3.* to 'dumper'@'localhost' identified by 'password';
grant all on zrlog3.* to 'dumper'@'localhost' identified by 'password';

#! /bin/bash
#daily backup part
dump=/usr/local/mysql/bin/mysqldump
user=dumper
pw=password
tip=172.31.215.157
la=`date +%Y-%m-%d`
sdate=`date +%d`
dir=/data/backup

#local backup
for db in discuz3 dedecms3 zrlog3;      #使用了for 语句,确实简单很多;
   do
        $dump -u$user -p$pw $db > $dir/"$db"_$la.sql
        sleep 2
        rsync -av $dir/"$db"_$la.sql $tip:$dir/"$db"_$sdate.sql   #rsync同步同时修改名字可以让远端保留30天的文件;
   done
   
#compress
zdate=`date -d "-2day" +%Y-%m-%d`    #使用时间区分要压缩的文件;
gzip /data/backup/*$zdate.sql     #gzip可以将每个文件单独压缩;
#del
ddate=`date -d "-7day" +%Y-%m-%d`    #使用时间区分要删除的文件;
if [ ! -d "/data/backup/del" ]
        then 
	   mkdir /data/backup/del
fi	
mv $dir/*$ddate* $dir/del/      #先移动到目录,后删除,更安全;
rm -rf $dir/del/*

任务计划
使用tanytan帐号建立如下计划任务(命令最好不要加用户名)
crontab -e
# *  *  *  *  * user-name  command to be executed
01 03 * * *  /usr/bin/bash /home/tanytan/sqlbackup.sh

脚本权限
[tanytan@ape-test3010 ~]$ ll /home/tanytan/
total 8
-rwxr-xr-x 1 tanytan root    907 Dec  8 15:27 sqlbackup.sh

静态文件备份

  • 架构里静态文件保存在nfs服务器上,需要多一份备份放置在备份服务器里
  • 也是用到rsync命令同步
  • 需要普通用户备份,另外使用密钥认证
  • 这个部分可参考上一个部分,并无新的内容
  • 备份周期与数据库同步

数据恢复文档

  • nfs服务器下线,不能上线,即可使用备份服务器变成nfs服务器
    备份服务器要做好nfs的配置
    修改三台web服务器的挂载点
    如果nfs与备份服务器使用keepalived实现高可用,即可马上恢复
    nfs恢复后,需手动同步最新数据,然后可将nfs上线;

  • 如果主数据库下线,不能上线,由于是双主结构,数据基本是同步的,可以手动切换到二主数据库上,或使用keepalived自动切换;
    如想数据更同步,应考虑使用半同步模式,主机收到的命令返回成功前,会写上relay log,所以主与二主不同步将极少发生;
    主数据库可上线后,待与二主数据同步后,可将主数据库重新上线;

zabbix监控

  • zabbix内网机器安装要顺利需要把所有依赖包都下载下来,再一次过安装;
 Package                 架构       版本                    源                                            大小
===============================================================================================================
正在安装:
 zabbix-agent            x86_64     4.0.15-1.el7            /zabbix-agent-4.0.15-1.el7.x86_64            1.6 M
 zabbix-get              x86_64     4.0.15-1.el7            /zabbix-get-4.0.15-1.el7.x86_64              1.2 M
 zabbix-server-mysql     x86_64     4.0.15-1.el7            /zabbix-server-mysql-4.0.15-1.el7.x86_64     5.0 M
 zabbix-web              noarch     4.0.15-1.el7            /zabbix-web-4.0.15-1.el7.noarch               16 M
 zabbix-web-mysql        noarch     4.0.15-1.el7            /zabbix-web-mysql-4.0.15-1.el7.noarch        0.0  
为依赖而安装:
 OpenIPMI                x86_64     2.0.27-1.el7            base                                         243 k
 OpenIPMI-libs           x86_64     2.0.27-1.el7            base                                         523 k
 OpenIPMI-modalias       x86_64     2.0.27-1.el7            base                                          16 k
 OpenIPMI-perl           x86_64     2.0.27-1.el7            base                                         167 k
 apr                     x86_64     1.4.8-5.el7             base                                         103 k
 apr-util                x86_64     1.5.2-6.el7             base                                          92 k
 fping                   x86_64     3.10-4.el7              epel                                          46 k
 gnutls                  x86_64     3.3.29-9.el7_6          base                                         680 k
 httpd                   x86_64     2.4.6-90.el7.centos     base                                         2.7 M
 httpd-tools             x86_64     2.4.6-90.el7.centos     base                                          91 k
 iksemel                 x86_64     1.4-2.el7.centos        zabbix-non-supported                          49 k
 libevent                x86_64     2.0.21-4.el7            base                                         214 k
 libtool-ltdl            x86_64     2.4.2-22.el7_3          base                                          49 k
 libzip                  x86_64     0.10.1-8.el7            base                                          48 k
 mailcap                 noarch     2.1.41-2.el7            base                                          31 k
 net-snmp-libs           x86_64     1:5.7.2-43.el7          base                                         750 k
 nettle                  x86_64     2.7.1-8.el7             base                                         327 k
 php                     x86_64     5.4.16-46.1.el7_7       updates                                      1.4 M
 php-bcmath              x86_64     5.4.16-46.1.el7_7       updates                                       58 k
 php-cli                 x86_64     5.4.16-46.1.el7_7       updates                                      2.7 M
 php-common              x86_64     5.4.16-46.1.el7_7       updates                                      565 k
 php-gd                  x86_64     5.4.16-46.1.el7_7       updates                                      128 k
 php-ldap                x86_64     5.4.16-46.1.el7_7       updates                                       53 k
 php-mbstring            x86_64     5.4.16-46.1.el7_7       updates                                      505 k
 php-mysql               x86_64     5.4.16-46.1.el7_7       updates                                      101 k
 php-pdo                 x86_64     5.4.16-46.1.el7_7       updates                                       99 k
 php-xml                 x86_64     5.4.16-46.1.el7_7       updates                                      126 k
 t1lib                   x86_64     5.1.2-14.el7            base                                         166 k
 trousers                x86_64     0.3.14-2.el7            base                                         289 k
 unixODBC                x86_64     2.3.1-14.el7            base                                         413 k

事务概要
===============================================================================================================
安装  5 软件包 (+30 依赖软件包)

yum localinstall OpenIPMI-2.0.27-1.el7.x86_64.rpm OpenIPMI-libs-2.0.27-1.el7.x86_64.rpm OpenIPMI-modalias-2.0.27-1.el7.x86_64.rpm OpenIPMI-perl-2.0.27-1.el7.x86_64.rpm apr-1.4.8-5.el7.x86_64.rpm apr-util-1.5.2-6.el7.x86_64.rpm fping-3.10-4.el7.x86_64.rpm gnutls-3.3.29-9.el7_6.x86_64.rpm httpd-2.4.6-90.el7.centos.x86_64.rpm httpd-tools-2.4.6-90.el7.centos.x86_64.rpm iksemel-1.4-2.el7.centos.x86_64.rpm libevent-2.0.21-4.el7.x86_64.rpm libtool-ltdl-2.4.2-22.el7_3.x86_64.rpm libzip-0.10.1-8.el7.x86_64.rpm  mailcap-2.1.41-2.el7.noarch.rpm net-snmp-libs-5.7.2-43.el7.x86_64.rpm nettle-2.7.1-8.el7.x86_64.rpm php-7.3.0.tar.bz2 php-bcmath-5.4.16-46.1.el7_7.x86_64.rpm php-cli-5.4.16-46.1.el7_7.x86_64.rpm php-common-5.4.16-46.1.el7_7.x86_64.rpm php-gd-5.4.16-46.1.el7_7.x86_64.rpm php-ldap-5.4.16-46.1.el7_7.x86_64.rpm php-mbstring-5.4.16-46.1.el7_7.x86_64.rpm php-mysql-5.4.16-46.1.el7_7.x86_64.rpm php-pdo-5.4.16-46.1.el7_7.x86_64.rpm php-xml-5.4.16-46.1.el7_7.x86_64.rpm t1lib-5.1.2-14.el7.x86_64.rpm trousers-0.3.14-2.el7.x86_64.rpm unixODBC-2.3.1-14.el7.x86_64.rpm zabbix-agent-4.0.15-1.el7.x86_64.rpm zabbix-server-mysql-4.0.15-1.el7.x86_64.rpm zabbix-web-4.0.15-1.el7.noarch.rpm zabbix-web-mysql-4.0.15-1.el7.noarch.rpm zabbix-get-4.0.15-1.el7.x86_64.rpm

监控tomcat, 安装zabbix-java-gateway,同理把所有包一次过安装;
zabbix-agent可直接yum;

 Package                              架构            版本                              源                大小
===============================================================================================================
正在安装:
 zabbix-java-gateway                  x86_64          4.0.15-1.el7                      zabbix           764 k
为依赖而安装:
 copy-jdk-configs                     noarch          3.3-10.el7_5                      base              21 k
 java-1.8.0-openjdk-headless          x86_64          1:1.8.0.232.b09-0.el7_7           updates           32 M
 javapackages-tools                   noarch          3.4.1-11.el7                      base              73 k
 lksctp-tools                         x86_64          1.0.17-2.el7                      base              88 k
 pcsc-lite-libs                       x86_64          1.8.8-8.el7                       base              34 k
 python-javapackages                  noarch          3.4.1-11.el7                      base              31 k
 python-lxml                          x86_64          3.2.1-4.el7                       base             758 k
 tzdata-java                          noarch          2019c-1.el7                       updates          187 k

事务概要
===============================================================================================================
安装  1 软件包 (+8 依赖软件包)

实际监控实现

  • 添加了基础监控,自定义linux监控模板;
    在这里插入图片描述

流量监控

在这里插入图片描述

  • web服务器两个nginx虚拟主机分别实现监控
    虚拟主机配置文件请参考上面;
    监控脚本如下:
[root@ape-test3001 ~]# cat /usr/local/sbin/ngx_bbs_status.sh /usr/local/sbin/ngx_www_status.sh 
#!/bin/bash
url="bbs.yuankeedu.com/nginx_status" 	#定义两个变量,放便使用;
curl="/usr/bin/curl -x127.0.0.1:80"

# 检测nginx进程是否存在
function bbsping {
    /sbin/pidof nginx | wc -l 
}
# 检测nginx性能
function bbsactive {
    $curl $url 2>/dev/null| grep 'Active' | awk '{print $NF}'
}
function bbsreading {
    $curl $url 2>/dev/null| grep 'Reading' | awk '{print $2}'
}
function bbswriting {
    $curl $url 2>/dev/null| grep 'Writing' | awk '{print $4}'
}
function bbswaiting {
    $curl $url 2>/dev/null| grep 'Waiting' | awk '{print $6}'
}
function bbsaccepts {
    $curl $url 2>/dev/null| awk NR==3 | awk '{print $1}'
}
function bbshandled {
    $curl $url 2>/dev/null| awk NR==3 | awk '{print $2}'
}
function bbsrequests {
    $curl $url 2>/dev/null| awk NR==3 | awk '{print $3}'
}
$1

#!/bin/bash
url="bbs.yuankeedu.com/nginx_status" 	#定义两个变量,放便使用;
curl="/usr/bin/curl -x127.0.0.1:80"

# 检测nginx进程是否存在
function wwwping {
    /sbin/pidof nginx | wc -l 
}
# 检测nginx性能
function wwwactive {
    $curl $url 2>/dev/null| grep 'Active' | awk '{print $NF}'
}
function wwwreading {
    $curl $url 2>/dev/null| grep 'Reading' | awk '{print $2}'
}
function wwwwriting {
    $curl $url 2>/dev/null| grep 'Writing' | awk '{print $4}'
}
function wwwwaiting {
    $curl $url 2>/dev/null| grep 'Waiting' | awk '{print $6}'
}
function wwwaccepts {
    $curl $url 2>/dev/null| awk NR==3 | awk '{print $1}'
}
function wwwhandled {
    $curl $url 2>/dev/null| awk NR==3 | awk '{print $2}'
}
function wwwrequests {
    $curl $url 2>/dev/null| awk NR==3 | awk '{print $3}'
}
$1

zabbix-agent配置文件增加语句,引用此配置文件
UserParameter=bbs.status[*],/usr/local/sbin/ngx_bbs_status.sh $1
UserParameter=www.status[*],/usr/local/sbin/ngx_www_status.sh $1

zabbix-web界面添加模板,模板新增item
在这里插入图片描述

在这里插入图片描述

新增trigger - 活动连接数大于100报警
在这里插入图片描述

  • mysql常规监控
    zabbix-agent自带监控的脚本,需要调整环境变量或做软链接,让需要到的程序能够使用
    定义监控数据库的帐户,将认证信息写在文档里;
    即可在web界面添加agent和相应模板监控数据库;
    在这里插入图片描述

  • 自定义数据库慢查询数量脚本和队列脚本

[root@ape-test3005 ~]# cat /usr/local/sbin/processlist.sh /usr/local/sbin/slowsql.sh 
#! /bin/bash
mysql=/usr/local/mysql/bin/mysql
log="-umo -ppassword -h172.31.215.153"
number () {
        $mysql $log -e "show processlist;" 2> /dev/null | wc -l
}
$1

#! /bin/bash
f=`/usr/bin/date +%Y-%m-%d`T`date +%H`
min=`/usr/bin/date -d "1 minutes ago"  +%M`
slow () {
number=`cat /data/mysql/slow.log |grep $f:$min: |wc -l`  #通过日期,字母,小时与分钟,统计前一分钟日志的行数;
echo $number
}
$1

慢查询日志格式
# Time: 2019-12-08T09:42:23.966295Z
# User@Host: root[root] @ localhost []  Id:   867
# Query_time: 3.000198  Lock_time: 0.000000 Rows_sent: 1  Rows_examined: 0
use discuz;
SET timestamp=1575798143;
select sleep (3);
# Time: 2019-12-08T09:42:57.953561Z
# User@Host: root[root] @ localhost []  Id:   873
# Query_time: 3.000204  Lock_time: 0.000000 Rows_sent: 1  Rows_examined: 0
SET timestamp=1575798177;
select sleep (3);

zabbix-agent中引用脚本
UserParameter=mysql.processlist[*],/usr/local/sbin/processlist.sh $1
UserParameter=mysql.1minslow[*],/usr/local/sbin/slowsql.sh $1

zabbix-web界面调用脚本,监控与报警
在这里插入图片描述

在这里插入图片描述

慢查询大于60报警

队列大于300报警
在这里插入图片描述

  • JMX监控tomcat
    tomcat新增JMX模块用于监控tomcat,会启动自定义端口,下图的9999端口;
    zabbix-server端新增zabbix-java-gateway用于从JMX接口接收数据,会启动java-gateway服务,10052端口;
    zabbix-java-gateway设置参数
    zabbix-server设置gateway的相关参数
    即可在zabbix-web上增加tomcat主机
    在这里插入图片描述

在这里插入图片描述

代码上线脚本:

#! /bin/bash
# code syn to different server
#reminder
read -p "你是否已经更新了文件列表/root/synfile.list?确认请输入y或者Y,否则按其他任意键退出脚本。" c
if [ -z "$c" ]      #没有输入退出;
	then
   	   exit 1
fi
if [ $c == "y" -o $c == "Y" ]     #输入Y or y继续执行,否则退出;
	then
	   echo "脚本将在2秒后,继续执行。"
	   for i in 1 2       #延时功能;
		do
		   echo -n "."
		   sleep 1				
		done
	   echo
	else
	   exit 1
fi
#clean the /root/rsync.exp file      #主同步expect函数,只执行一次,完成后删除,以免错误执行;
[ -f /root/rsync.exp ] && rm -f /root/rsync.exp    #检查有没有同名称文件残留,删除;

#create the rsync.exp
cat > /root/rsync.exp <<EOF				#新建一个脚本文件,EOF结束;

#expect interact function      #开始输入;
# /usr/bin/expect
set passwd "password" 
set host [lindex \$argv 0]     #参数1赋给expect函数;
set file [lindex \$argv 1]        #参数2赋给expect函数;
spawn rsync -av --files-from=\$file / root@\$host:/     #使用获取到的文件列表,和IP同步到指定服务器;
expect {
"yes/no" {send "yes\r"}
"password:" {send \$passwd\r} 
}
expect eof 
EOF

chmod a+x /root/rsync.exp      #./rsync.exp这样运行时要做这个操作;

#function to check whether a file exist
if_file_exist()
{
if [ ! -f $1 ]
   then
	echo "文件$1不存在,请检查。"
	exit 1
fi
}

if_file_exist /root/ip.list
if_file_exist /root/synfile.list

for ip in `cat /root/ip.list`     #读取ip.list把ip逐个实施;
   do
	expect /root/rsync.exp $ip /root/synfile.list    
   done

rm -f /root/rsync.exp      #删除expect函数;
  • 同步列表里可以是文件,也可以是目录,如下
[root@second ~]# ls -ld  /root/synt /tmp/syna /usr/local/synn /data/syny
drwxr-xr-x 2 root root 6 11月 22 12:36 /data/syny
-rw-r--r-- 1 root root 0 11月 22 12:34 /root/synt
drwxr-xr-x 2 root root 6 11月 22 12:35 /tmp/syna
-rw-r--r-- 1 root root 0 11月 22 12:36 /usr/local/synn
[root@second ~]# vi ./syn.txt   #文件内容如下;
/root/synt
/tmp/syna
/usr/local/synn
/data/syny
  • 0
    点赞
  • 1
    收藏
  • 打赏
    打赏
  • 1
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
©️2022 CSDN 皮肤主题:大白 设计师:CSDN官方博客 返回首页
评论 1

打赏作者

tanyyinyu

你的鼓励将是我创作的最大动力

¥2 ¥4 ¥6 ¥10 ¥20
输入1-500的整数
余额支付 (余额:-- )
扫码支付
扫码支付:¥2
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、C币套餐、付费专栏及课程。

余额充值