ืกืคึผืืื ืง ืืื ืืืื ืขืจ ืคืื ืขืืืขืืข ืคืื โโโโืื ืืขืจืกื ืจืขืงืึทืื ืืืืึทืืึทื ืืขืฉืขืคื ืืึธื ืืึทืืืื ื ืืื ืึทื ืึทืืืกืืก ืคึผืจืึธืืืงืื. ืืคืืื ืืืฆื, ืืืขื ืคืืจืงืืืคืื ื ืืื ื ืื ืืขืจ ืืขืืืื ืืื ืจืืกืืึทื ื, ืืึธืก ืืื ื ืืฉื ืึท ืกืืื ื ืืฉื ืฆื ืฉืจืืึทืื ืื ืกืืจืึทืงืฉืึทื ื / ืืื-ืฆื ืคึฟืึทืจ ืืขื ืคึผืจืึธืืืงื.
ืึทืจืืขื: ืงืืืึทืื ืกืืกืืขื ืืึธืืก ืคึฟืื ืืึธืงืงืขืจ ื ืึธืืื ืืื ืกืคึผืืื ืง ืึธื ืืฉืึทื ืืื ื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื ืื ืืึทืืขืืึธืก ืืึทืฉืื
ืืื ืืืึธืื ืืื ืฆื ืึธื ืืืืื ืืื ืืขืจ ืืึทืึทืืืขืจ ืฆืืืึทื ื, ืืืึธืก ืงืืงื ืึท ืืืกื ืืึธืื ืข ืืืขื ื ืืฆื ืืึธืงืขืจ.
ืืืึธืก ืืืจ ืืึธืื:
1. ืคึผืืืื ืืืื
$ docker pull splunk/universalforwarder:latest2. ืึธื ืืืื ืืขื ืงืึทื ืืืื ืขืจ ืืื ืื ื ืืืืืง ืคึผืึทืจืึทืืขืืขืจืก
$ docker run -d -p 9997:9997 -e 'SPLUNK_START_ARGS=--accept-license' -e 'SPLUNK_PASSWORD=<password>' splunk/universalforwarder:latest3. ืืืจ ืืืื ืืื ืืขื ืงืึทื ืืืื ืขืจ
docker exec -it <container-id> /bin/bashืืขืจื ืึธื, ืืืจ ืืขื ืขื ืืขืืขืื ืฆื ืืืื ืฆื ืึท ืืึทืืืืกื ืึทืืจืขืก ืืื ืื ืืึทืงืืืืขื ืืืืฉืึทื.
ืืื ืงืึทื ืคืืืืขืจ ืืขื ืงืึทื ืืืื ืขืจ ื ืึธื ืขืก ืกืืึทืจืฅ:
./splunk add forward-server <host name or ip address>:<listening port>
./splunk add monitor /var/log
./splunk restart
ืืืึทืจืื. ืืืืก?
ืืืขืจ ืื ืกืึทืคึผืจืืืืื ืืึธื ื ืื ืกืืฃ ืืึธืจื. ืืืื ืืืจ ืืืืคื ืืขื ืงืึทื ืืืื ืขืจ ืคึฟืื ืืขืจ ืืึทืึทืืืขืจ ืืืื ืืื ืื ืืขืจืึทืงืืืื ืืึธืืข, ืืืจ ืืืขื ืืขื ืื ืคืืืืขื ืืข:
ืึท ืืืกื ืึทื ืืืืฉืื ื
$ docker run -it -p 9997:9997 -e 'SPLUNK_START_ARGS=--accept-license' -e 'SPLUNK_PASSWORD=password' splunk/universalforwarder:latest
PLAY [Run default Splunk provisioning] *******************************************************************************************************************************************************************************************************
Tuesday 09 April 2019 13:40:38 +0000 (0:00:00.096) 0:00:00.096 *********
TASK [Gathering Facts] ***********************************************************************************************************************************************************************************************************************
ok: [localhost]
Tuesday 09 April 2019 13:40:39 +0000 (0:00:01.520) 0:00:01.616 *********
TASK [Get actual hostname] *******************************************************************************************************************************************************************************************************************
changed: [localhost]
Tuesday 09 April 2019 13:40:40 +0000 (0:00:00.599) 0:00:02.215 *********
Tuesday 09 April 2019 13:40:40 +0000 (0:00:00.054) 0:00:02.270 *********
TASK [set_fact] ******************************************************************************************************************************************************************************************************************************
ok: [localhost]
Tuesday 09 April 2019 13:40:40 +0000 (0:00:00.075) 0:00:02.346 *********
Tuesday 09 April 2019 13:40:40 +0000 (0:00:00.067) 0:00:02.413 *********
Tuesday 09 April 2019 13:40:40 +0000 (0:00:00.060) 0:00:02.473 *********
Tuesday 09 April 2019 13:40:40 +0000 (0:00:00.051) 0:00:02.525 *********
Tuesday 09 April 2019 13:40:40 +0000 (0:00:00.056) 0:00:02.582 *********
Tuesday 09 April 2019 13:40:41 +0000 (0:00:00.216) 0:00:02.798 *********
included: /opt/ansible/roles/splunk_common/tasks/change_splunk_directory_owner.yml for localhost
Tuesday 09 April 2019 13:40:41 +0000 (0:00:00.087) 0:00:02.886 *********
TASK [splunk_common : Update Splunk directory owner] *****************************************************************************************************************************************************************************************
ok: [localhost]
Tuesday 09 April 2019 13:40:41 +0000 (0:00:00.324) 0:00:03.210 *********
included: /opt/ansible/roles/splunk_common/tasks/get_facts.yml for localhost
Tuesday 09 April 2019 13:40:41 +0000 (0:00:00.094) 0:00:03.305 *********
ะฝั ะธ ัะฐะบ ะดะฐะปะตะต...
ืืจืืืก. ืืขืจ ืืืื ืืื ื ืืฉื ืืคืืื ืึทื ืืืึทืืื ืึท ืึทืจืืืคืึทืงื. ืืึธืก ืืื, ืืขืืขืจ ืืึธื ืืืจ ืึธื ืืืื ืขืก ืืืขื ื ืขืืขื ืฆืืื ืฆื ืึธืคึผืืึธืืืจื ืื ืึทืจืงืืืื ืืื ืืื ืึทืจืืขืก, ืึทื ืคึผืึทืง ืขืก ืืื ืงืึทื ืคืืืืขืจ ืขืก.
ืืืึธืก ืืืขืื ืืึธืงืขืจ-ืืืขื ืืื ืึทืืข ืืืึธืก?
ื ืืื ื ืืื ืง. ืืืจ ืืืขืื ื ืขืืขื ืึทื ืึทื ืืขืจ ืืืขื. ืืืึธืก ืืืื ืืืจ ืืืจืืคืืจื ืึทืืข ืื ืึทืคึผืขืจืืืฉืึทื ื ืืื ืื ืคึฟืึทืจืืึทืืืื ื ืืื ืข? ืืขืจืืืขืจ ืืึธืื ืก ืืืื!
ืึผืื ื ืืฉื ืฆื ืคืึทืจืืึทืืื ืฆื ืืึทื ื, ืืื ืืืขื ืืืืึทืื ืืืจ ืื ืืขืฆื ืืืื ืืืืื:
dockerfile
# ะขัั ั ะบะพะณะพ ะบะฐะบะธะต ะฟัะตะดะฟะพััะตะฝะธั
FROM centos:7
# ะะฐะดะฐัะผ ะฟะตัะตะผะตะฝะฝัะต, ััะพะฑั ะบะฐะถะดัะน ัะฐะท ะฟัะธ ััะฐััะต ะฝะต ัะบะฐะทัะฒะฐัั ะธั
ENV SPLUNK_HOME /splunkforwarder
ENV SPLUNK_ROLE splunk_heavy_forwarder
ENV SPLUNK_PASSWORD changeme
ENV SPLUNK_START_ARGS --accept-license
# ะกัะฐะฒะธะผ ะฟะฐะบะตัั
# wget - ััะพะฑั ัะบะฐัะฐัั ะฐััะตัะฐะบัั
# expect - ะฟะพะฝะฐะดะพะฑะธััั ะดะปั ะฟะตัะฒะพะฝะฐัะฐะปัะฝะพะณะพ ะทะฐะฟััะบะฐ Splunk ะฝะฐ ััะฐะฟะต ัะฑะพัะบะธ
# jq - ะธัะฟะพะปัะทัะตััั ะฒ ัะบัะธะฟัะฐั
, ะบะพัะพััะต ัะพะฑะธัะฐัั ััะฐัะธััะธะบั ะดะพะบะตัะฐ
RUN yum install -y epel-release
&& yum install -y wget expect jq
# ะะฐัะฐะตะผ, ัะฐัะฟะฐะบะพะฒัะฒะฐะตะผ, ัะดะฐะปัะตะผ
RUN wget -O splunkforwarder-7.2.4-8a94541dcfac-Linux-x86_64.tgz 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.2.4&product=universalforwarder&filename=splunkforwarder-7.2.4-8a94541dcfac-Linux-x86_64.tgz&wget=true'
&& wget -O docker-18.09.3.tgz 'https://download.docker.com/linux/static/stable/x86_64/docker-18.09.3.tgz'
&& tar -xvf splunkforwarder-7.2.4-8a94541dcfac-Linux-x86_64.tgz
&& tar -xvf docker-18.09.3.tgz
&& rm -f splunkforwarder-7.2.4-8a94541dcfac-Linux-x86_64.tgz
&& rm -f docker-18.09.3.tgz
# ะก shell ัะบัะธะฟัะฐะผะธ ะฒัั ะฟะพะฝััะฝะพ, ะฐ ะฒะพั inputs.conf, splunkclouduf.spl ะธ first_start.sh ะฝัะถะดะฐัััั ะฒ ะฟะพััะฝะตะฝะธะธ. ะะฑ ััะพะผ ัะฐััะบะฐะถั ะฟะพัะปะต source ััะณะฐ.
COPY [ "inputs.conf", "docker-stats/props.conf", "/splunkforwarder/etc/system/local/" ]
COPY [ "docker-stats/docker_events.sh", "docker-stats/docker_inspect.sh", "docker-stats/docker_stats.sh", "docker-stats/docker_top.sh", "/splunkforwarder/bin/scripts/" ]
COPY splunkclouduf.spl /splunkclouduf.spl
COPY first_start.sh /splunkforwarder/bin/
# ะะฐัะผ ะฟัะฐะฒะฐ ะฝะฐ ะธัะฟะพะปะฝะตะฝะธะต, ะดะพะฑะฐะฒะปัะตะผ ะฟะพะปัะทะพะฒะฐัะตะปั ะธ ะฒัะฟะพะปะฝัะตะผ ะฟะตัะฒะพะฝะฐัะฐะปัะฝัั ะฝะฐัััะพะนะบั
RUN chmod +x /splunkforwarder/bin/scripts/*.sh
&& groupadd -r splunk
&& useradd -r -m -g splunk splunk
&& echo "%sudo ALL=NOPASSWD:ALL" >> /etc/sudoers
&& chown -R splunk:splunk $SPLUNK_HOME
&& /splunkforwarder/bin/first_start.sh
&& /splunkforwarder/bin/splunk install app /splunkclouduf.spl -auth admin:changeme
&& /splunkforwarder/bin/splunk restart
# ะะพะฟะธััะตะผ ะธะฝะธั ัะบัะธะฟัั
COPY [ "init/entrypoint.sh", "init/checkstate.sh", "/sbin/" ]
# ะะพ ะถะตะปะฐะฝะธั. ะะพะผั ะฝัะถะฝะพ ะปะพะบะฐะปัะฝะพ ะธะผะตัั ะบะพะฝัะธะณะธ/ะปะพะณะธ, ะบะพะผั ะฝะตั.
VOLUME [ "/splunkforwarder/etc", "/splunkforwarder/var" ]
HEALTHCHECK --interval=30s --timeout=30s --start-period=3m --retries=5 CMD /sbin/checkstate.sh || exit 1
ENTRYPOINT [ "/sbin/entrypoint.sh" ]
CMD [ "start-service" ]ืึทืืื ืืืึธืก ืืื ืงืึทื ืืืื ื ืืื
first_start.sh
#!/usr/bin/expect -f
set timeout -1
spawn /splunkforwarder/bin/splunk start --accept-license
expect "Please enter an administrator username: "
send -- "adminr"
expect "Please enter a new password: "
send -- "changemer"
expect "Please confirm new password: "
send -- "changemer"
expect eofืืื ืืขืจ ืขืจืฉืืขืจ ืึธื ืืืื, Splunk ืคืจืขืื ืืืจ ืฆื ืืขืื ืขืก ืึท ืืึธืืื / ืคึผืึทืจืึธื, ืึธืืขืจ ืื ืืึทืื ืืขื ืขื ืืขื ืืฆื ืืืืื ืฆื ืืืกืคืืจื ืึทืืืื ืืกืืจืึทืืืืืข ืงืึทืืึทื ืื ืคึฟืึทืจ ืืขื ืืึทืืื ืืขืจ ืืึทื ืืึธื ืืืจืื ื, ืืึธืก ืืื, ืื ืืขื ืงืึทื ืืืื ืขืจ. ืืื ืืื ืืืขืจ ืคืึทื, ืืืจ ื ืึธืจ ืืืืื ืฆื ืงืึทืืขืจ ืืขื ืงืึทื ืืืื ืขืจ ืึทืืื ืึทื ืึทืืฅ ืึทืจืืขื ืืื ืื ืืึธืืก ืืืืคื ืืื ืึท ืืืึทื. ืคืื ืงืืจืก, ืืึธืก ืืื ืืึทืจืืงืึธืืข, ืึธืืขืจ ืืื ืืึธืื ื ืื ืืขืคึฟืื ืขื ืงืืื ืื ืืขืจืข ืืืขืื.
ืืืืึทืืขืจ ืืืื ืื ืฉืจืืคื ืืื ืขืงืกืึทืงืืืืึทื
/splunkforwarder/bin/splunk install app /splunkclouduf.spl -auth admin:changemesplunkclouduf.spl - ืืึธืก ืืื ืึท ืงืจืึทืืขื ืืฉืึทืื ืืขืงืข ืคึฟืึทืจ Splunk Universal Forwarder, ืืืึธืก ืงืขื ืขื ืืืื ืืึทืื ืืึธืืืื ืคึฟืื ืื ืืืขื ืฆืืืื ื.
ืืื ืฆื ืืื ืฆื ืึธืคึผืืึธืืืจื (ืืื ืืืืืขืจ)
ืืึธืก ืืื ืึท ืจืขืืืืขืจ ืึทืจืงืืืื ืืืึธืก ืงืขื ืขื ืืืื ืึทื ืคึผืึทืงื. ืื ืืขื ืขื ืกืขืจืืืคืืงืึทืฅ ืืื ืึท ืคึผืึทืจืึธื ืคึฟืึทืจ ืงืึทื ืขืงืืื ื ืฆื ืืื ืืืขืจ SplunkCloud ืืื outputs.conf ืืื ืึท ืจืฉืืื ืคืื ืืื ืืืขืจ ืึทืจืืึทื ืฉืจืืึทื ืื ืกืืึทื ืกืื. ืืขืจ ืืขืงืข ืืืขื ืืืื ืืึทืืืึทืืืง ืืื ืืืจ ืจืืื ืกืืึทื ืืืื ืกืคึผืืื ืง ืืึทื ืืึธื ืืืจืื ื ืึธืืขืจ ืืืืื ืึทื ืึทืจืืึทื ืฉืจืืึทื ื ืึธืืข ืืืื ืื ืื ืกืืึทืืืจืื ื ืืื ืืืืฃ-ืืึทื ืึธืืข. ืืขืจืืืขืจ, ืขืก ืืื ืืึธืจื ืืฉื ืคืึทืืฉ ืืื ืึทืืื ื ืขืก ืื ืืขื ืงืึทื ืืืื ืขืจ.
ืืื ืื ืืขืฆืืข ืืึทื ืืื ืจืืกืืึทืจื. ืืึธ, ืฆื ืฆืืืืืื ืื ืขื ืืขืจืื ืืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืจืืกืืึทืจื ืขืก.
ืืื ืืื ืืขืจ inputs.conf ืืืจ ืืืืื ืื ืืึธืืก ืืืึธืก ืืืจ ืืืืื ืฆื ืฉืืงื ืฆื ืกืคึผืืื ืง. ืขืก ืืื ื ืื ื ืืืืืง ืฆื ืืืืื ืืขื ืืขืงืข ืฆื ืื ืืืื ืืืื, ืืืฉื, ืืืจ ืคืึทืจืฉืคึผืจืืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืืืจื ืืืึทืืงืข. ืืขืจ ืืืืื ืืึทื ืืื ืึทื ืคืึธืจืืืขืจืืขืจ ืืขื ืื ืงืึธื ืคืืืก ืืืขื ืื ืืืืืึทื ืกืืึทืจืฅ, ืึทื ืืขืจืฉ ืขืก ืืืขื ืืึทืจืคึฟื ./ืกืคึผืื ืง ืจืืกืืึทืจื.
ืืืึธืก ืืื ืคืื ืืึธืงืงืขืจ ืกืืึทืฅ ืกืงืจืืคึผืก ืืขื ืขื ืืื? ืขืก ืืื ืึทื ืึทืื ืืืืืื ื ืืืืฃ Github ืคึฟืื , ืื ืกืงืจืืคึผืก ืืขื ืขื ืืขื ืืืขื ืคืื ืืึธืจื ืืื ืืึทืืึทืคืืื ืฆื ืึทืจืืขืื ืืื ืงืจืึทื ื ืืืขืจืกืืขืก ืคืื ืืึธืงืงืขืจ (ืกืข-17.*) ืืื ืกืคึผืืื ืง (7.*).
ืืื ืื ืืืงืืืขื ืืึทืื, ืืืจ ืงืขื ืขื ืืืืขื ืื ืคืืืืขื ืืข
ืืึทืฉืืึธืจืื: (ืึท ืคึผืึธืจ ืคืื ืืืืืขืจ)
ืืขืจ ืืงืืจ ืงืึธื ืคึฟืึทืจ ืืึทืฉืขืก ืืื ืืื ืื ืืื ืง ืฆืืืขืฉืืขืื ืืื ืื ืกืืฃ ืคืื ืืขื ืึทืจืืืงื. ืืืืข ืืึธื ืึทื ืขืก ืืขื ืขื 2 ืกืขืืขืงืืขื ืคืขืืืขืจ: 1 - ืืื ืืขืงืก ืกืขืืขืงืฆืืข (ืืขืืืื ืืืจื ืืึทืกืงืข), ืืึทืืขืืึธืก / ืงืึทื ืืืื ืขืจ ืกืขืืขืงืฆืืข. ืืืจ ืืืขื ืืกืชึผืื ืืึทืจืคึฟื ืฆื ืืขืจืืืึทื ืืืงื ืื ืืื ืืขืงืก ืืึทืกืงืข, ืืืคึผืขื ืืื ื ืืืืฃ ืื ื ืขืืขื ืืืจ ื ืืฆื.
ืืื ืืกืงื ื, ืืื ืืืึธืื ืืื ืฆื ืฆืืขื ืืืื ืืคืืขืจืงืืึทืืงืืึทื ืฆื ืื ืคึฟืื ืงืฆืืข ืึธื ืืืื() ะฒ
entrypoint.sh
start() {
trap teardown EXIT
if [ -z $SPLUNK_INDEX ]; then
echo "'SPLUNK_INDEX' env variable is empty or not defined. Should be 'dev' or 'prd'." >&2
exit 1
else
sed -e "s/@index@/$SPLUNK_INDEX/" -i ${SPLUNK_HOME}/etc/system/local/inputs.conf
fi
sed -e "s/@hostname@/$(cat /etc/hostname)/" -i ${SPLUNK_HOME}/etc/system/local/inputs.conf
sh -c "echo 'starting' > /tmp/splunk-container.state"
${SPLUNK_HOME}/bin/splunk start
watch_for_failure
}ืืื ืืืื ืคืึทื, ืคึฟืึทืจ ืืขืืขืจ ืกืืืืืืข ืืื ืืขืืขืจ ืืืื ืขื ืืืื, ืืืื ืึท ืึทืคึผืืึทืงืืืฉืึทื ืืื ืึท ืงืึทื ืืืื ืขืจ ืึธืืขืจ ืึท ืืึทืืขืืึธืก ืืึทืฉืื, ืืืจ ื ืืฆื ืึท ืืึทืืื ืืขืจ ืืื ืืขืงืก. ืืขื ืืืขื, ืื ืืืื ืืืืงืืึทื ืืืขื ื ืืฉื ืืืึทืื ืืืขื ืขืก ืืื ืึท ืืึทืืืืืืง ืึทืงืืืืืึทืืืืฉืึทื ืคืื ืืึทืื. ื ืคึผืฉืื ืืขืจืฉื ืืื ืืขื ืืฆื ืฆื ื ืึธืืขื ืื ืืขืงืกืื: _. ืืขืจืืืขืจ, ืืื ืกืืจ ืคึฟืึทืจ ืื ืงืึทื ืืืื ืขืจ ืฆื ืืืื ืื ืืืืขืจืกืึทื, ืืืจ ืคืึทืจืืืึทืื ืื ืืขืืึธื ืืื ืืืืืขืจ ืืึธื ืืฉืื ื ืืึธืจืฉื-ืื ืืืืืืงืึทืจื ืฆื ืื ื ืึธืืขื ืคืื ืื ืกืืืืืืข. ืืขืจ ืกืืืื ื ืึธืืขื ืืืขืจืืึทืืึทื ืืื ืืืจืืืขืืื ืืขื ืืืจื ืกืืืืืืข ืืืขืจืืึทืืึทืื. ืกืึธืื ืืก ืืึธืื ืข.
ืขืก ืืื ืืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ืคึฟืึทืจ ืขืืืขืืข ืกืืื ืกืคึผืืื ืง ืืื ื ืืฉื ืึทืคืขืงืืึทื ืืืจื ืืขื ืืืึทืืืึทื ืคืื ืื ืืึธืงืงืขืจ ืคึผืึทืจืึทืืขืืขืจ hostname. ืขืจ ืืืขื ื ืึธื ืกืืึทืืขืจื ืื ืฉืืงื ืืึธืืก ืืื ืื ืฉืืึทื ืคืื ืืืื ืงืึทื ืืืื ืขืจ ืืื ืื ืืึทืืขืืึธืก ืคืขืื. ืืื ืึท ืืืืืื ื, ืืืจ ืงืขื ืขื ืึธื ืงืืึทืคึผื / ืขืืง / ืืึธืกืื ืึทืืข ืคึฟืื ืืขืจ ืืึทืืขืืึธืก ืืึทืฉืื ืืื ืืื ืกืืึทืจืืึทืคึผ ืืึทืื ืจืืคึผืืืืกืืึทื ืฅ ืขื ืืขื ืฆื ืืื ืืขืงืก ื ืขืืขื.
ืืืึทืฉืคึผืื docker-compose.yml
version: '2'
services:
splunk-forwarder:
image: "${IMAGE_REPO}/docker-stats-splunk-forwarder:${IMAGE_VERSION}"
environment:
SPLUNK_INDEX: ${ENVIRONMENT}
volumes:
- /etc/hostname:/etc/hostname:ro
- /var/log:/var/log
- /var/run/docker.sock:/var/run/docker.sock:roืืึทื ืฅ
ืืึธ, ืืึธืืขืจ ืื ืืืืืื ื ืืื ื ืืฉื ืืืขืึทื ืืื ืืืืขืจ ื ืืฉื ืื ืืืืขืจืกืึทื ืคึฟืึทืจ ืึทืืขืืขื, ืืืืึทื ืขืก ืืขื ืขื ืคืืืข "ืืึทืจืืงืึธืืข". ืึธืืขืจ ืืืืืจื ืืืืฃ ืขืก, ืึทืืขืืขื ืงืขื ืขื ืืืืขื ืืืืขืจ ืืืืื ืืืื ืืื ืฉืืขืื ืขืก ืืื ืืืืขืจ ืคึผืจืืืืึทื ืึทืจืืืคืึทืงืืึธืจื, ืืืื, ืืื ืขืก ืืึทืคึผืึทื ื, ืืืจ ืืึทืจืคึฟื Splunk Forwarder ืืื ืืึธืงืงืขืจ.
ืืื ืงืก:
ืืงืืจ: www.habr.com