Splunk及splunkforward簡單部署配置

標籤：

部署環境作業系統

伺服器作業系統版本：CentOS release 6.5 (Final) 2.6.32-431.el6.x86_64

軟體

軟體版本：splunk-6.4.0

tar:

         splunk-6.4.0-f2c836328108-Linux-x86_64.tgz

         splunkforwarder-6.4.0-f2c836328108-Linux-x86_64.tgz

rpm: splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm

         splunkforwarder-6.4.0-f2c836328108-linux-2.6-x86_64.rpm

IP地址

splunk伺服器Ip地址：192.168.0.156

splunkforwarder伺服器位址：192.168.0.140

splunk安裝tar安裝splunk

 

splunkforwarder

tar xzfv /usr/src/splunkforwarder-6.4.0-f2c836328108-Linux-x86_64.tgz -C /usr/local/

echo “export PATH=/usr/local/splunkforwarder/bin:$PATH” >> /etc/profile

source /etc/profile

 

rpm安裝splunksplunkforwarder

rpm -ivh /usr/src/splunkforwarder-6.4.0-f2c836328108-linux-2.6-x86_64.rpm

echo “export PATH=/opt/splunkforwarder/bin:$PATH” >> /etc/profile

source /etc/profile

啟動關閉

啟動：splunk start

關閉：splunk stop

重啟：splunk restart

設定開機啟動

splunk enable boot-start

更改web連接埠及管理連接埠

l  splunk set splunkd-port 9998

l  splunk set web-port 80

配置基本設定檔splunk

$SPLUNK_HOME/etc/system/local/inputs.conf

$SPLUNK_HOME/etc/system/local/server.conf

$SPLUNK_HOME/etc/system/local/web

splunkforward

$SPLUNK_HOME/etc/system/local/inputs.conf

$SPLUNK_HOME/etc/system/local/outputs.conf

$SPLUNK_HOME/etc/system/local/server.conf

splunkinputs.conf

[default]

host = 192.168.0.156

index = _internal

 

[splunktcp:///9997]

server.conf

[general]

serverName = 192.168.0.156

sessionTimeout = 1h

web

[settings]

startwebserver = 1

httpport = 80

mgmtHostPort = 127.0.0.1:8089

splunkforwarderinputs.conf

[default]

index         = _internal

host = 192.168.0.140

 

[monitor:///var/log/maillog]

 

[monitor:///usr/local/tomcat-7.0.67/logs/catalina.out]

 

[monitor:///usr/local/jboss-5.1.0.GA/server/default/log/server.log]

sourcetype = log4j

outputs.conf

[tcpout]

defaultGroup=my_server

 

[tcpout:my_server]

server=192.168.0.156:9997

 

[tcpout-server://192.168.0.156:9997]

server.conf

[general]

serverName = 192.168.0.140

sessionTimeout = 1h

破解破解splunk匯入資料500M限制

cd $ SPLUNK_HOME

vim lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/licensing.py

         if action == ‘add‘ and not pool_object.quota_bytes[‘byte_value‘]:

            quota_value = max(0, int(unallocated_bytes / 2**20))

            quota_value = quota_value * 1024 * 1024

        else:

            quota_value = (pool_object.quota_bytes[‘byte_value‘] or 0) / 2**20

            quota_value = quota_value * 1024 * 1024

        #quota_units = ‘MB‘

        quota_units = ‘TB‘

mv lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/licensing.pyo /root

splunk restart

更改許可證

改為：Free許可證組

Web方式(使用瀏覽器訪問http://plunk_server_ip:8000)

設定》授權》更改許可證組

選 Free 許可證

重啟splunk

如下轉載資料來源配置主機日誌使用Syslog服務Linux主機/防火牆/交換器

Linux/vpn網關/防火牆/交換器等支援udp/tcp日誌傳輸的裝置就直接使用udp/tcp傳輸的方式把日誌傳到splunk伺服器

操作步驟：

splunk監聽連接埠

在splunk上啟用接受日誌的監聽連接埠

tcp: 514連接埠

udp:514連接埠

web方式:

添加資料>>syslog>>UDP>>新增

填514連接埠

如果使用tcp，操作同udp方式

Linux/vpn網關/防火牆/交換器等配置發送日誌到splunk伺服器

以Linux為樣本：

配置Linux中的rsyslog服務

# vim /etc/rsyslog.conf

*.* @192.168.3.70:514               #udp模式

 

重啟rsyslog

# service rsyslog restart

應用日誌

依賴splunk universal forwarder

WebLogic和oracle日誌

Splunk及splunkforward簡單部署配置