graylog 启动流程

启动流程:

Main函数参数: server -f graylog.conf.example

uploading.4e448015.gif转存失败重新上传取消

 

主要框架:com.github.rvesse.airline,主要将shell命令参数和java类绑定,根据传参获取对应类的实例,final Runnable command = cli.parse(args);
然后启动实例,由于启动参数是sever,绑定的类是org.graylog2.commands.server

[i]启动server实例

Server类层级如下:

uploading.4e448015.gif转存失败重新上传取消

 

运行run启动该实例,run的逻辑如下

uploading.4e448015.gif转存失败重新上传取消

初始化日志

//初始化日志 默认是info
final Level logLevel = setupLogger();

 

获取plug module,主要有三个

uploading.4e448015.gif转存失败重新上传取消

获取config module, 有14个。

uploading.4e448015.gif转存失败重新上传取消

//初始化pid文件及netty io.netty.native.workdir配置        

uploading.4e448015.gif转存失败重新上传取消

获取config module

获取config module ,其实就是所有的配置类添加NamedConfigParametersModule容器

 

uploading.4e448015.gif转存失败重新上传取消

创建上下文

系统自动注入上面获取的plugn module 和 config module, 使用的是google的guice 依赖注入框架。框架具体看我的博客:

https://www.baidu.com/link?url=fkBYiMOdue8xayUttrRxWCWk847sFL3fp--VRpuOg6Z6E-FePftH9hTafrZ0V5mFkp9Hqd3Nm9w8FAZ7Wgeu60YNN047UCutIt8qqjJ3o4O&wd=&eqid=d65bc96d00002f64000000025ea4f451

 

依赖注入的类实在是太多,看来项目复杂度还不小,以后有时间可以仔细看看注入的类。

uploading.4e448015.gif转存失败重新上传取消

 

Guice常见上下文,也就是injector容器,创建所有入住类的实例,并保存在injector,后面需要实例,直接可以通过injector获取

 

GenericInitializerBindings

启动jmx

启动jmxreporter 暴露服务运行metrics, metrics主要使用了

com.codahale.metrics;

 

uploading.4e448015.gif转存失败重新上传取消

启动service

这个地方使用了google的Guava Service框架,这个框架到处都用,个人觉得是java常用组件的升级版本。

uploading.4e448015.gif转存失败重新上传取消

具体代码如下

@Override

protected void startCommand() {

    final AuditEventSender auditEventSender = injector.getInstance(AuditEventSender.class);

    final NodeId nodeId = injector.getInstance(NodeId.class);

    final String systemInformation = Tools.getSystemInformation();

    final Map<String, Object> auditEventContext = ImmutableMap.of(

        "version", version.toString(),

        "java", systemInformation,

        "node_id", nodeId.toString()

    );

    auditEventSender.success(AuditActor.system(nodeId), NODE_STARTUP_INITIATE, auditEventContext);

    //获取操作系统参数

    final OS os = OS.getOs();



    final ServerStatus serverStatus = injector.getInstance(ServerStatus.class);

    //初始化server状态为starting

    serverStatus.initialize();

    //

    startNodeRegistration(injector);



    final ActivityWriter activityWriter;

    final ServiceManager serviceManager;

    try {

        activityWriter = injector.getInstance(ActivityWriter.class);

        serviceManager = injector.getInstance(ServiceManager.class);

    } catch (ProvisionException e) {

        LOG.error("Guice error", e);

        annotateProvisionException(e);

        auditEventSender.failure(AuditActor.system(nodeId), NODE_STARTUP_INITIATE, auditEventContext);

        System.exit(-1);

        return;

    } catch (Exception e) {

        LOG.error("Unexpected exception", e);

        auditEventSender.failure(AuditActor.system(nodeId), NODE_STARTUP_INITIATE, auditEventContext);

        System.exit(-1);

        return;

    }

    Runtime.getRuntime().addShutdownHook(new Thread(injector.getInstance(shutdownHook())));

    // propagate default size to input plugins

    MessageInput.setDefaultRecvBufferSize(configuration.getUdpRecvBufferSizes());

    // Start services.

    final ServiceManagerListener serviceManagerListener = injector.getInstance(ServiceManagerListener.class);

    serviceManager.addListener(serviceManagerListener);

    try {

        serviceManager.startAsync().awaitHealthy();

    } catch (Exception e) {

        try {

            serviceManager.stopAsync().awaitStopped(configuration.getShutdownTimeout(), TimeUnit.MILLISECONDS);

        } catch (TimeoutException timeoutException) {

            LOG.error("Unable to shutdown properly on time. {}", serviceManager.servicesByState());

        }

        LOG.error("Graylog startup failed. Exiting. Exception was:", e);

        auditEventSender.failure(AuditActor.system(nodeId), NODE_STARTUP_INITIATE, auditEventContext);

        System.exit(-1);

    }

    LOG.info("Services started, startup times in ms: {}", serviceManager.startupTimes());



    activityWriter.write(new Activity("Started up.", Main.class));

    LOG.info("Graylog " + commandName + " up and running.");

    auditEventSender.success(AuditActor.system(nodeId), NODE_STARTUP_COMPLETE, auditEventContext);



    // Block forever.

    try {

        Thread.currentThread().join();

    } catch (InterruptedException e) {

        return;


    }

}

至此,整个server服务完全启动,后面可以分析每个具体service了。

 

 

## 什么是graylog Graylog 是一个简单易用、功能较全面的日志管理工具,相比 ELK 组合, 优点: - 部署维护简单 - 查询语法简单易懂(对比ES的语法…) - 内置简单的告警 - 可以将搜索结果导出为 json - 提供简单的聚合统计功能 - UI 比较友好 - 当然, 拓展性上比 ELK 差很多。 整套依赖: - Graylog 提供 graylog 对外接口 - Elasticsearch 日志文件的持久化存储和检索 - MongoDB 只是存储一些 Graylog 的配置 ## 安装 > 可以是裸机安装,也可以是docker安装,这里用docker安装 环境要求: - centos7.4 - cpu2个 内存2G 参考: https://hub.docker.com/r/graylog2/graylog/ ### 环境准备 ``` mkdir /root/graylog && cd /root/graylog //挂载目录 mkdir -p mongo_data graylog_journal es_data //配置文件目录 mkdir -p ./graylog/config cd ./graylog/config wget https://raw.githubusercontent.com/Graylog2/graylog-docker/3.0/config/graylog.conf wget https://raw.githubusercontent.com/Graylog2/graylog-docker/3.0/config/log4j2.xml //提前准备镜像 docker pull mongo:3 docker pull graylog/graylog:3.0 docker pull elasticsearch:5.6.9 ``` ### docker-compose.yml ``` version: '2' services: # MongoDB: https://hub.docker.com/_/mongo/ mongo: image: mongo:3 volumes: - ./mongo_data:/data/db - /etc/localtime:/etc/localtime # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/docker.html elasticsearch: image: elasticsearch:5.6.9 volumes: - ./es_data:/usr/share/elasticsearch/data - /etc/localtime:/etc/localtime environment: - http.host=0.0.0.0 - transport.host=localhost - network.host=0.0.0.0 # Disable X-Pack security: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/security-settings.html#general-security-settings - xpack.security.enabled=false - "ES_JAVA_OPTS=-Xms512m -Xmx512m" ulimits: memlock: soft: -1 hard: -1 mem_limit: 1g # Graylog: https://hub.docker.com/r/graylog/graylog/ graylog: image: graylog/graylog:3.0 volumes: - ./graylog_journal:/usr/share/graylog/data/journal - ./graylog/config:/usr/share/graylog/data/config - /etc/localtime:/etc/localtime environment: # CHANGE ME! - GRAYLOG_PASSWORD_SECRET=somepasswordpepper # Password: admin - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 # 这里需要修改为要暴露的机器的地址 - GRAYLOG_HTTP_EXTERNAL_URI=http://10.121.60.2:9000/ links: - mongo - elasticsearch ports: # Graylog web interface and REST API - 9000:9000 # Syslog TCP - 514:514 # Syslog UDP - 514:514/udp # GELF TCP - 12201:12201 # GELF UDP - 12201:12201/udp # GELF HTTP - 12202:12202 ``` ### 启动 `docker-compose -f docker-compose.yml up -d` 通过http://10.121.60.2:9000/访问web,admin/admin ### 修改配置 - email相关(告警需要) ``` transport_email_enabled = true transport_email_hostname = smtp.163.com transport_email_port = 994 transport_email_use_auth = true transport_email_use_tls = true transport_email_use_ssl = true transport_email_auth_username = 17191093767@163.com transport_email_auth_password = zhim123456 transport_email_subject_prefix = [graylog] transport_email_from_email = 17191093767@163.com transport_email_web_interface_url = http://10.121.60.2:9000 ``` ## 使用 ### 配置添加Inputs > Graylog 节点能够接受数据的类型称之为input,常见的有GELF TCP, GELF UDP, GELF HTTP. 说明:GELF TCP, GELF UDP可以使用同一个端口,HTTP需要另起端口,原因不解释。 - 添加三个input,过程略,tcp,udp端口使用默认的12201,http端口使用12202。 - 验证 ``` // udp echo -n '{ "version": "1.1", "host": "example.org", "short_message": "A short message info with udp", "level": 1, "_some_info": "foo", "_tag": "test11" }' | nc -w10 -u 10.121.60.2 12201 // tcp echo -n -e '{ "version": "1.1", "host": "example.org", "short_message": "A short message with tcp", "level": 1, "_some_info": "foo" }'"\0" | nc -w10 10.121.60.2 12201 //http curl -X POST -H 'Content-Type: application/json' -d '{ "version": "1.1", "host": "example.org", "short_message": "A short message with http", "level": 5, "_some_info": "foo" }' 'http://10.121.60.2:12202/gelf' ``` ### docker 日志添加到graylog ``` docker run --log-driver=gelf \ --log-opt gelf-address=udp://10.121.60.2:12201 \ --log-opt tag=test1 \ -v /etc/localtime:/etc/localtime \ -it nginx /bin/bash ``` docker-compose.yaml ``` services: mongo: logging: driver: "gelf" options: gelf-address: "udp://10.121.60.2:12201" tag: mongo volumes: - /etc/localtime:/etc/localtime ``` ### java日志直接发送到graylog > 使用logback ``` 10.121.60.2 12201 <!--An example of overwriting the short message pattern--> %ex{short}%.100m <!-- Use HTML output of the full message. Yes, any layout can be used (please don't actually do this)--> %d{MM-dd HH:mm:ss.SSS} [%thread] %-5level \(%F:%L\) - %msg %n true true true true requestId:long <!--Facility is not officially supported in GELF anymore, but you can use staticFields to do the same thing--> tag business-server ``` ## 系统使用 功能菜单说明 - search 日志查询面板 ![](assets/2018-07-10-11-52-07.png) - streams 将日志对象按照filed定义为stream,默认的stream为all messages ![](assets/2018-07-10-11-52-22.png) - alerts 告警相关,选择一个stream对象定义告警条件和通知方式,当stream里面的日志满足条件时候告警并通知 ![](assets/2018-07-10-11-52-35.png) - dashboards 图形面板 ![](assets/2018-07-10-11-52-53.png) - source 告警所在主机 ![](assets/2018-07-10-11-53-37.png) - system 系统配置 ![](assets/2018-07-10-11-53-52.png) ### 查询条件 [官方说明文档](http://docs.graylog.org/en/3.0/pages/queries.html) > 关键字不分大小写 - 单个关键字查询 `ssh` - 多关键字查询,含有ssh or login `ssh login` - 含有某个字符串查询 `ssh login` - 同时含有多个关键字查询 `opening index" AND db` - 根据字段值查询 `tag:couchdb.peer0.org1.ygsoft.com` - 含有多个tag的查询,某条记录只要其中一个字段满足即可 ``` tag: (orderer.ygsoft.com couchdb.peer0.org1.ygsoft.com) or tag: orderer.ygsoft.com couchdb.peer0.org1.ygsoft.com ``` - 含有完全匹配字段 `tag:"ssh login"` - 含有某个字段的记录: `_exists_:tag` - 不含有某个字段的记录: `NOT _exists_:tag` - AND OR `"ssh login" AND source:example.org` `("ssh login" AND (source:example.org OR source:another.example.org)) OR _exists_:always_find_me` - NOT ``` "ssh login" AND NOT source:example.org NOT example.org ``` 注意: AND, OR, and NOT 只能大写. - 通配符 ? 表示单个字符 星号表示0个和多个字符 ``` source:*.org source:exam?le.org source:exam?le.* ``` 注意:默认首字母不能使用通配符,因为这样会使用大量的内存;强行开启修改配置文件`allow_leading_wildcard_searches = true` - 当某关键字不确认顺序的时候使用~ ``` ssh logni~ source:exmaple.org~ 结果可以匹配 ssh login and example.org ``` - 以下字符在使用的时候必须用反斜杠转义 ``` && || : \ / + - ! ( ) { } [ ] ^ " ~ * ? Example: resource:\/posts\/45326 ``` ### 查询条件可以保存下来 使用 save search criteria 按钮
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值