260 likes | 281 Views
Work Together Effectively. Content in the Cloud - Operations. Open Source . Monitoring in the cloud. Ishara Fernando Senior Linux Systems Administrator – Infrastructure & Security . Senior Linux Systems Administrator – Infrastructure & Security.
E N D
Open Source Monitoring in the cloud Ishara Fernando Senior Linux Systems Administrator – Infrastructure & Security Senior Linux Systems Administrator – Infrastructure & Security Senior Linux Systems Administrator – Infrastructure & Security Senior Linux Systems Administrator – Infrastructure & Security
What’s our problem ? • Small Team • Lots of Users (All untrusted) • Lots of Systems • Lots of Logs • Lots of workload on Systems • Lots of performance bottlenecks • Lots of performance metrics to monitor
How to overcome ? Monitoring Logs Monitoring Performance Collectd Graphite Database (eg: PSQL) Grafana Dashboard • Logstash • Redis • Elasticsearch • Kibana Dashboard
Log Monitoring software : What it does • Logstash –Collects ,Stores and Parses logs • Redis - Message broker • Eleasticsearch - Search Server • Kibana - Provides nice visualization for Elasticsearch , could be served on Nginx/Apache
Data Sources - Logstash Logstash forwarders • Linux/Unix Syslog • Windows Event Log • Packet captures (Eg: tcpdump pcap files) • SNMP traps
Logstash configuration • input { file {#Alfresco Audit Syslog File path => [ "/var/log/audit.log" ] } • filter { grok {#Regex expression to filter logs which needs to be sent to elasticsearch type => "alfresco" match => [ "message", "%{SYSLOGTIMESTAMP} (?:%{SYSLOGHOST} )?%{DATA}: %{GREEDYDATA:data}" ] } • output {#Output to elasticsearch elasticsearch_http { host => localhost port => 9200 }
AWS – Elasticsearch & Kibana • We can use the elasticsearch managed service provided by AWS which will be ease : • Administration • Scalable • To integrate with logstash & Kibana • Highly secure
Performance monitoring Software – What it does • Collectd – Collects system performance statistics inorder to send it to carbon-cache • Graphite – 3 components • Carbon-cache – Network service which Listens for incoming metrics in a buffer/cache • Whisper - Stores time series data (RRD format) • Graphite webapp – Renders graphs • Database (Eg: Postgresql) – Stores user info , permissions,graph and dashboard configurations • Grafana – Graphite data displayed with customized cool graphs (Could be served on Nginx/Apache)
Data Sources - Graphite • By default Collectd sends data to graphite such as : • CPU • Network • Memory • Disk • Processes • ‘Collectd’ can be used to monitor performance/workload of : • Databases such as MySQL , Postgresql • Java based applications (Eg: Tomcat) by sending JMX related data (Eg : Heapmemory / Non heap memory usage , busythreads , etc)
Collectd Configuration for JMX cat collectd.conf LoadPlugin java <Plugin "GenericJMX"> <MBean "classes"> <Value> Type "jmx_memory” Table true Attribute "HeapMemoryUsage" InstancePrefix "heap-" </Value> </MBean>
Performance Analysis – Grafana Dashboard(Output of JMX data)
Grafana with AWS Cloudwatch Grafana ships with built in support for AWS cloudwatch Authentication & Authorization from Grafana to AWS cloudwatch is handled by AWS access & secret keys The keys are stored under $GRAFANA_HOME/.aws/credentials
Summary • Real-time centralized logs from many sources • Real-time suspicious & intrusion logs • Logs can be stored for any amount of time • Logstash/Kibana can be easily deployed in cloud services such as AWS • Real-time performance monitoring metrics from many sources • Easy to identify bottlenecks • Easy to identify and co-relate any bottlenecks caused for further system performance tuning • Grafana is available for IAAS services such as in AWS which can use AWS Cloudwatch as the source of metrics
Founded 2007 London& Colombo Experts in digitisation 66 People Certified Staff