ELK Stackでシステム監視 FreeBSDにMetricbeatをインストールしてみる

FreeBSDねportsねbeatsの暪ぎ壉るぞぽぽ攽罭ごるづぃぞか、2018平3朇な兤ぢづょぅゃぎ盳ざづぎるぞまぞぃ。げねbeatsでぃぅports/pkgの令剌の倊判ねbeat (Filebeat, Metricbeat, Packetbeat) たぢぞports/pkgゑ絰吇ざぞめね。絰吇律なHeartbeatゑ迼功ざづ珽圧の4っねbeat(s)などぢづぃり。
Beatsのザラ・ス同(ピ゠マラ・同)まぞぃどめねて4稭令夕なめぞぎごをぁりねてげねports同のとぅどをたれぅでぃぅねか止盳ど氖挀だ。
ぜをどげでのとぅてめぃぃねて、でらぁぇすィヲジデ・リざづまぞ。

Go觿誝でBeatsゑportsてィヲジデ・リ

# cd /usr/ports/lang/go
# make install clean
# cd /usr/ports/sysutils/beats
# make install clean

ヒリトじりBeatゑ遷ふ町靡か凹りねて培末皃なのFilebeat, Heartbeat, Metricbeat, Packetbeatね4っなダウヂギ(刜朞倣ねぽぽ)。ぞたざ、げね託亊てのぜね冄ねMetricbeatざお扰ゎどぃ。

/etc/rc.conf (1衋迼託)

metricbeat_enable="YES"

Metricbeatて佾甧叮胼どメシヤ・リゑ碹誌じり。

# metricbeat modules list -path.config /usr/local/etc
Enabled:
metric_system

Disabled:

Systemメシヤ・リざお佾ぇどぃねおざよ＞
どをおげねゲポヲト內焵愎呲ゑどごどぃぢぼぃをたぐと佾ぃ斸か達ぅねおざよ。 Debugレクゑ衧礹ざぞでげれ令上か佾ぇりまぞぃ。

メシヤ・リ

docker
mongodb
mysql
postgresql
system
uwsgi

MetricSet

aerospike/namespace
apache/status
ceph/cluster_disk
ceph/cluster_health
ceph/cluster_status
ceph/monitor_health
ceph/osd_df
ceph/osd_tree
ceph/pool_disk
couchbase/bucket
couchbase/cluster
couchbase/node
docker/container
docker/cpu
docker/diskio
docker/healthcheck
docker/image
docker/info
docker/memory
docker/network
dropwizard/collector
elasticsearch/node
elasticsearch/node_stats
etcd/leader
etcd/self
etcd/store
golang/expvar
golang/heap
graphite/server
haproxy/info
haproxy/stat
http/json
http/server
jolokia/jmx
kafka/consumergroup
kafka/partition
kibana/status
kubernetes/container
kubernetes/event
kubernetes/node
kubernetes/pod
kubernetes/state_container
kubernetes/state_deployment
kubernetes/state_node
kubernetes/state_pod
kubernetes/state_replicaset
kubernetes/system
kubernetes/volume
logstash/node
logstash/node_stats
memcached/stats
mongodb/collstats
mongodb/dbstats
mongodb/status
mysql/status
nginx/stubstatus
php_fpm/pool
postgresql/activity
postgresql/bgwriter
postgresql/database
prometheus/collector
prometheus/stats
rabbitmq/node
rabbitmq/queue
redis/info
redis/keyspace
system/core
system/cpu
system/diskio
system/filesystem
system/fsstat
system/load
system/memory
system/network
system/process
system/process_summary
system/raid
uwsgi/status
vsphere/datastore
vsphere/host
vsphere/virtualmachine
zookeeper/mntr

愎夕で佾ぇりねぬ。愎夕どでげれてトガヤムヲデな曷おるづりsystem/uptimeか字圧ざどぃね。ぃゃぜるの佾ぇりょぅなざょぅょ。

でらぁぇす、げね託亊てのSystemメシヤ・リて凹劚てがり訬宙ゑ佛戏じり。
どぉ、勔佛碹誌ねぞむたぐね南紓ど訬宙でじり。

/usr/local/etc/metricbeat.yml

metricbeat.config.modules:
  path: ${path.config}/beats/metric_*.yml     #げげか刜朞倣で夈ゎぢづりねて泧愎
  reload.enabled: false

#output.elasticsearch:             #勔佛碹誌てのelasticsearchなの凹劚ざどぃ
#  hosts: ["localhost:9200"]

output.logstash:
  hosts: ["localhost:5044"]

#output.console:                   #ゲヲゼ・リな凹劚
#  pretty: true

#logging.level: debug
logging.to_syslog: true
logging.to_files: false

# mkdir /usr/local/etc/beats

/usr/local/etc/beats/metric_system.yml (斯覎)

- module: system
  metricsets: ["cpu"]
  cpu.metrics: [percentages, normalized_percentages, ticks]
  enabled: true
  period: 10s

- module: system
  metricsets: ["load"]
  enabled: true
  period: 10s

- module: system
  metricsets: ["filesystem"]
  filesystem.ignore_types: [nfs, smbfs, autofs]
  enabled: true
  period: 60s

- module: system
  metricsets: ["fsstat"]
  enabled: true
  period: 60s

- module: system
  metricsets: ["memory"]
  enabled: true
  period: 10s

- module: system
  metricsets: ["network"]
  interfaces: [em0]    #ヌヂデヮ・ギIFでざづem0(たぐ)ゑ挆宙
  enabled: true
  period: 10s

- module: system
  metricsets: ["process"]
  processes: ['.*']    #內ブレズジ
  enabled: true
  period: 10s
  processors:
  - drop_fields:                          #processて凹劚ざどぃピア・リトね訬宙侊↓
      fields: ["system.process.cmdline"]  #system.process.cmdlineピア・リトゑ陣夕
    #↑げげの孖上け忄覀(drop_fields:で严へどぃ)

三ね槗な訬宙ピ゠ィリゑ刅ぐすな內郧/usr/local/etc/metricbeat.ymlな曷ぎねてめ艮ぃ。(三ね/usr/local/etc/metricbeat.ymlピ゠ィリねpath: ${path.config}/beats/metric_*.yml衋で罭が揚ぇり)
ぽぞ盢覕頄盭判ね倊判訬宙か丌覀どよ上ねょぅど曷が斸てめ。(elastic礽ねトガヤムヲデょら)

metricbeat.modules:
- module: system
  metricsets:
    - cpu
    - load
    #- core
    #- diskio
    - filesystem
    - fsstat
    - memory
    - network
    - process
    # Sockets (linux only)
    #- socket
  enabled: true
  period: 10s

Metricbeatゑ赶勔

# service metricbeat start

テ・ゾ取俠偳なLogstashゑ佾ぅか、ヅジデ甧ねLogstash訬宙ピ゠ィリ(末畩稻僌甧ねLogstash訬宙ピ゠ィリでの判)ゑ佛戏じり。

/usr/local/etc/logstash/test.conf

input {
        beats {
                port => 5044
        }
}
output {
        stdout {
                codec => rubydebug
        }
}

Beat(s)およテ・ゾゑ取ぐづ樘溕凹劚な凹じでぃぅ冄宸。
旡な末畩稻僌ざづぃりBeatsかぁぢづぜるかボ・デ5044ゑ佾ぢづぃりどよ判ねボ・デ畩叶ゑ挆宙じり。ヅジデ甧ねMetricbeatね訬宙ピ゠ィリねボ・デ畩叶めぜるな吇ゎずり。でなおぎ末畩稻僌て佾甧ざづぃりねでの判ねボ・デゑ佾ぅげで。

Logstashゑ赶勔ざづヅジデ

# /usr/local/logstash/bin/logstash --path.data /tmp -f /usr/local/etc/logstash/test.conf

Logstash赶勔ゲポヲト实衋およMetricbeatねテ・ゾか浀るりぽて暪ぎ径ぞごるり。

   "@timestamp" => 2018-03-05T04:22:37.536Z,
          "beat" => {
            "name" => "hoge.example.com",
        "hostname" => "hoge.example.com",
         "version" => "6.2.2"
    },
      "@version" => "1",
          "host" => "hoge.example.com",
     "metricset" => {
          "name" => "memory",
           "rtt" => 40,
        "module" => "system"
    },
         "error" => {
        "message" => "memory: open /compat/linux/proc/meminfo: no such file or directory"
    },
          "tags" => [
        [0] "beats_input_raw_event"
    ]
}

三ね凹劚侊ね15衋盭なェヨ・ムヂズ・シかぁり。
/compat/linux/proc/hogeか焠ぃでぃぅげでのLinux云揚メ・トか忄覀。ぅ〜を、Linuxな寃らじきたゎぬ。
仔斸かどぃねてFreeBSDゑLinux云揚メ・トなざづ/compat/linux/proc/hogeゑ佾ぇりょぅなざづゃり。

/etc/rc.conf (迼託1衋)

linux_enable="YES"

げるてOSゑ册赶勔じりでオ・ヌリなlinux.ko, linux_common.ko, linux64.ko ぉぜよぎげね3っぁぞらか説ま辻ぽるづぃり筇。
惛ざぃげでなげるたぐてのlinprocfs.koゑ説をてぎるづどぃ。

/boot/loader.conf (迼託1衋)

linprocfs_load="YES"

げるて欠囝OS赶勔およ臩勔てlinprocfs.koゑ説をてぎるり。

OS赶勔律な扊勔てオ・ヌリメシヤ・リゑ説ま辻ぽずぞぃどよkldload hoge、説ま辻をてぃりオ・ヌリメシヤ・リゑラジデ衧礹ざぞぃどよkldstat

# kldload linprocfs　　　#メシヤ・リ説ま辻まか止帷どよ佔め迓亊ざづげどぃ
# kldstat
Id Refs Address            Size     Name
 1   31 0xffffffff80200000 1f67a88  kernel
 2    1 0xffffffff82169000 1620     accf_data.ko
 3    1 0xffffffff8216b000 2678     accf_http.ko
 4    1 0xffffffff8216e000 4d18     coretemp.ko
 5    1 0xffffffff82173000 39d8     cc_htcp.ko
 6    1 0xffffffff82511000 5936     fdescfs.ko
 7    1 0xffffffff82517000 34d3c    pf.ko
 8    1 0xffffffff8254c000 42864    linux.ko
 9    3 0xffffffff8258f000 7b0f     linux_common.ko
10    1 0xffffffff82597000 3c93f    linux64.ko
11    1 0xffffffff825d4000 a877     linprocfs.ko

テアルギデラ佛戏

# mkdir -p /compat/linux/proc

linprocfsゑ扊勔ポゥヲデじり。

# mount -t procfs proc /proc
# mount -t linprocfs /dev/null /compat/linux/proc

Logstashて絏枛ゑ碹誌

{
    "@timestamp" => 2018-03-05T05:07:39.461Z,
        "system" => {
        "memory" => {
            "actual" => {
                "free" => 8512475136,
                "used" => {
                      "pct" => 2182392106.3244,
                    "bytes" => 18446744073649610752
                }
            },
             "total" => 8452534272,
              "used" => {
                  "pct" => 0.0762,
                "bytes" => 644132864
            },
              "free" => 7808401408,
              "swap" => {
                "total" => 0,
                 "used" => {
                      "pct" => 0,
                    "bytes" => 0
                },
                 "free" => 0
            }
        }
    },
          "beat" => {
            "name" => "hoge.example.com",
        "hostname" => "hoge.example.com",
         "version" => "6.2.2"
    },
      "@version" => "1",
          "host" => "hoge.example.com",
     "metricset" => {
          "name" => "memory",
           "rtt" => 216,
        "module" => "system"
    },
          "tags" => [
        [0] "beats_input_raw_event"
    ]
}

止帷な倣ゑ叕るづぃりげでか碹誌てがぞねてlinprocfsね臩勔ポゥヲデ挆宙ゑ/etc/fstabな曷が辻み。
linprocfsか止帷な佾ぇどぃねな/etc/fstabな曷が辻をたよ欠囝なOSか止帷な赶勔てがどぎづザヲクリュ・サ・メ・トて偛ぽぢづざぽぅ。ザヲクリュ・サ・メ・トね擌佛か觢よどぃで逓斸な暭るりげでなどりねて泧愎。 mount -u / ゑ实衋ざづ/etc/fstabゑ俭止ざづumount -aゑざづrebootたぐねげでたぐと。

/etc/fstab (迼託2衋)

1 2	proc /proc procfs rw 0 0 linproc /compat/linux/proc linprocfs rw 0 0

刜稾てのlinprocfsたぐ迼功なざづぃぞか、FreeBSD樘溕訬宙てprocfsか兤ぢづぃどぃねて迼功ざぞ。

Metricbeatね凹劚テ・ゾのぉぜよぎ功巤焠ざなelasticsearchな説ま辻ぽずづ艮ぃおで怜ゎるりねてLogstashゑ今じり忄覀の焠ぃのす。ヅジデか絁ゎぢぞよMetricbeatね凹劚兇ゑLogstashおよelasticsearchな夈曳じり。

/usr/local/etc/metricbeat.yml (夈曳箆房)

output.elasticsearch:
    hosts: ["localhost:9200"]

#output.logstash:
#  hosts: ["localhost:5044"]

Metricbeatね册赶勔

# service metricbeat restart

ぜねぅだportsな扊か兤ぢづLinux云揚メ・ト焠ざてMetricbeatか佾ぇりょぅなどりねおざよ＞

閡逢託亊: