跳到主要内容

31 篇博文 含有标签「技术」

查看所有标签

# Debian10 更换国内源

· 阅读需 1 分钟

Debian10 更换国内源​

https://cloud.tencent.com/developer/article/1590080

Debian11 更换阿里源​

cp /etc/apt/sources.list /etc/apt/sources.list.back
echo "" >  /etc/apt/sources.list 

cat <<EOF > /etc/apt/sources.list 
deb http://mirrors.aliyun.com/debian/ bullseye main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ bullseye main non-free contrib
deb http://mirrors.aliyun.com/debian-security/ bullseye-security main
deb-src http://mirrors.aliyun.com/debian-security/ bullseye-security main
deb http://mirrors.aliyun.com/debian/ bullseye-updates main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ bullseye-updates main non-free contrib
deb http://mirrors.aliyun.com/debian/ bullseye-backports main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ bullseye-backports main non-free contrib
EOF

apt update
apt -y upgrade

微信报警

· 阅读需 2 分钟

微信报警​

启动容器​

docker run -d -e"ELASTICSEARCH_HOST=192.168.2.101" -e"ELASTICSEARCH_PORT=30080INER_TIMEZONE=Asia/Shanghai" -e"TZ=Asia/Shanghai" --name ea anjia0532/elastalert-docker:v0.2.4

进入容器​

docekr exec -it ea sh
cd rules

配置报警规则​

配置规则文件

# vi app.yaml
name: test
type: frequency
index: logstash-*
num_events: 1
timeframe:
  minutes: 1
filter:
- query:
    query_string:
      query: '"\[ERROR\]" NOT "发送邮件失败"'
alert:
  - "elastalert_modules.wechat_qiye_alert.WeChatAlerter"
wechat_corp_id: ww9b9c823d77fe3
wechat_secret: fHI8_cNIrTiSfrN7DRfvW-G1mcVCDEOTpRzBcEA
wechat_agent_id: 1002
wechat_party_id: 1
alert_text_type: alert_text_only
alert_text: |
  日志告警！
  截止发邮件前匹配到的请求数：{}
  截止发邮件前匹配到的次数：{}
  时间: {}
  内容: {}

alert_text_args:
  - num_hits
  - num_matches
  - "@timestamp"
  - message

index：要查询的索引的名称, ES中存在的索引。 num_events：此参数特定于frequency类型，并且是触发警报时的阈值。 filter：用于过滤结果的Elasticsearch过滤器列表，这里的规则定义是除了包含“发送邮件失败”的错误日志，其他所有ERROR的日志都会触发报警。 alert：定义报警方式，我们这里采用企业微信报警。 corp_id： 企业微信的接口认证信息

集成到pod中​

apiVersion: apps/v1
kind: Deployment
metadata:
  name: elastalert
  namespace: monitoring
  labels:
    app: elastalert
spec:
  selector:
    matchLabels:
      app: elastalert
  template:
    metadata:
      labels:
        app: elastalert
    spec:
      volumes:
      - name: rule
        hostPath:
          path: /data/k8s/monitor/elastalert/applog.yaml
      hostNetwork: true
      containers:
      - name: elastalert
        image: anjia0532/elastalert-docker:v0.2.4
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: rule
          mountPath: /opt/elastalert/rules/applog.yaml
        env:
        - name: TZ
          value: Asia/Shanghai
        - name: CONTAINER_TIMEZONE
          value: Asia/Shanghai
        - name: ELASTICSEARCH_HOST
          value: '192.168.2.101'
        - name: ELASTICSEARCH_PORT
          value: '30080'

程序bug​

rules.yaml的name值唯一的 如果程序重新加载了rules name值发生变化会报错 无法进行告警

ES 数据定期删除

· 阅读需 1 分钟

ES 数据定期删除​

创建清理脚本​

vim es-index-clear.sh

#/bin/bash
#只保留15天内的日志索引
LAST_DATA=`date -d "-15 days" "+%Y.%m.%d"`
#删除15天前的索引
curl -XDELETE 'http://ip:port/*-'${LAST_DATA}

添加定时任务​

#编辑crontab文件，添加相应的任务
crontab -e

#设置每天的凌晨一点清除索引
0 1 * * * root sh /opt/elk/scripts/es-index-clear.sh