在 graylog 5 使用的 Geolocation 功能 在 graylog 6 也被限制了
使用Geolocation 功能前必須 先有 Illuminate Processor
但這個功能在open版被限制了
2024/11/07
2024/11/06
graylog 6版後的index rotation改成了另一種方式
原本是設定
Max. days in storage
180
Min. days in storage
60
主觀認知是能查到60天內的資料 超過60天系統會封存 但應該還是能查到
但事實上超過60天就查不到資料了
為了符合法規規定 所以現在改成
Max. days in storage
181
Min. days in storage
180
覺得舊版的方式比較好
能自己決定几天後就把 index close
然後再看狀況手動去砍
認真查了一下才發現graylog現在分成了三個版本
open的這個版本現在大幅減少支援的功能
為了解決以上的問題
看來只能定期手動或用crontab去close index
shell 如下
for i in {171..180}
do
echo $i
curl -u use:passwd -XPOST "http://10.0.0.1:9200/graylog_$i/_close"
done
目前觀察大約是每二天會 index rotate 一次
需要查詢舊資料時再打開
curl -v -X POST -H "Content-Type: application/json" -H "X-Requested-By: XMLHttpRequest" -u user:passwd http://10.0.0.1:9000/api/system/indexer/indices/graylog_245/reopen
2024/05/10
2024/05/09
這几天進graylog時提示6版已經出來了
看官網說的是可以直接更新
還是先裝一台來試看看好了
這次用的是almalinux 9
6版已經不再支援 elasticsearch 了
依照官網安裝流程裝到opensearch就有問題了
安裝後無法啟動
看了一下 opensearch.yml
裡面有一段
######## Start OpenSearch Security Demo Configuration ########
# WARNING: revise all the lines below before you go into production
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: esnode.pem
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn: ['CN=kirk,OU=client,O=client,L=test,C=de']
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: [all_access, security_rest_api_access]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [.plugins-ml-agent, .plugins-ml-config, .plugins-ml-connector,
.plugins-ml-controller, .plugins-ml-model-group, .plugins-ml-model, .plugins-ml-task,
.plugins-ml-conversation-meta, .plugins-ml-conversation-interactions, .plugins-ml-memory-meta,
.plugins-ml-memory-message, .plugins-ml-stop-words, .opendistro-alerting-config,
.opendistro-alerting-alert*, .opendistro-anomaly-results*, .opendistro-anomaly-detector*,
.opendistro-anomaly-checkpoints, .opendistro-anomaly-detection-state, .opendistro-reports-*,
.opensearch-notifications-*, .opensearch-notebooks, .opensearch-observability, .ql-datasources,
.opendistro-asynchronous-search-response*, .replication-metadata-store, .opensearch-knn-models,
.geospatial-ip2geo-data*, .plugins-flow-framework-config, .plugins-flow-framework-templates,
.plugins-flow-framework-state]
node.max_local_storage_nodes: 3
######## End OpenSearch Security Demo Configuration ########
感覺是這段的問題
備分後重新開一個新的 opensearch.yml
裡面的內容只要以下這些就好
cluster.name: graylog
node.name: ${HOSTNAME}
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
discovery.type: single-node
network.host: 0.0.0.0
action.auto_create_index: false
plugins.security.disabled: true
indices.query.bool.max_clause_count: 32768
改完後啟動就沒問題了
跟之前不同 graylog這個版本安裝好後
打開 http://127.0.0.1:9000 無法進到web介面
看了一下 /var/log/graylog-server/server.log
It seems you are starting Graylog for the first time. To set up a fresh install, a setup interface has
been started. You must log in to it to perform the initial configuration and continue.
Initial configuration is accessible at 0.0.0.0:9000, with username 'admin' and password 'iIcCiFzjWY'.
Try clicking on http://admin:iIcCiFzjWY@0.0.0.0:9000
需要先 Initial configuration 才能使用
進入後依照畫面的步驟設定後 就能進入graylog的介面了
Memory/Heap usage 預設是1G 要再調整
/etc/sysconfig/graylog-server
GRAYLOG_SERVER_JAVA_OPTS="-Xms1g -Xmx1g -server -XX:+UseG1GC -XX:-OmitStackTraceInFastThrow"
依ram大小調整
訂閱：
文章 (Atom)