CentOS7 部署ElastiFlow网络流量分析平台

1、 调整系统内核参数

[root@elastiflow sysctl.d]# cat 100-elastiflow.conf
net.core.netdev_max_backlog=4096
net.core.rmem_default=262144
net.core.rmem_max=67108864
net.ipv4.udp_rmem_min=131072
net.ipv4.udp_mem=2097152 4194304 8388608
 
#less 75000 nodes
net.core.netdev_max_backlog=4096
net.core.rmem_default=262144
net.core.rmem_max=67108864
net.ipv4.udp_rmem_min=131072
net.ipv4.udp_mem=2097152 4194304 8388608
 
#more then 75000 nodes
net.core.netdev_max_backlog=8192
net.core.rmem_default=262144
net.core.rmem_max=134217728
net.ipv4.udp_rmem_min=131072
net.ipv4.udp_mem=4194304 8388608 16777216

2、 安装java环境

[root@elastiflow yum.repos.d]# yum install java-openjdk-devel java-openjdk
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
No package java-openjdk-devel available.
Resolving Dependencies
--> Running transaction check
---> Package java-1.8.0-openjdk.x86_64 1:1.8.0.292.b10-1.el7_9 will be installed
--> Processing Dependency: java-1.8.0-openjdk-headless(x86-64) = 1:1.8.0.292.b10-1.el7_9 for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: xorg-x11-fonts-Type1 for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libjvm.so(SUNWprivate_1.1)(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libjpeg.so.62(LIBJPEG_6.2)(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libjava.so(SUNWprivate_1.1)(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libXcomposite(x86-64) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: gtk2(x86-64) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libjvm.so()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libjpeg.so.62()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libjava.so()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libgif.so.4()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libXtst.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libXrender.so.1()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libXi.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libXext.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: libX11.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64
--> Running transaction check
---> Package giflib.x86_64 0:4.1.6-9.el7 will be installed
--> Processing Dependency: libSM.so.6()(64bit) for package: giflib-4.1.6-9.el7.x86_64
--> Processing Dependency: libICE.so.6()(64bit) for package: giflib-4.1.6-9.el7.x86_64
---> Package gtk2.x86_64 0:2.24.31-1.el7 will be installed
--> Processing Dependency: pango >= 1.20.0-1 for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libtiff >= 3.6.1 for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libXrandr >= 1.2.99.4-2 for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: atk >= 1.29.4-2 for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: hicolor-icon-theme for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: gtk-update-icon-cache for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libpangoft2-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libpangocairo-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libpango-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libgdk_pixbuf-2.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libcups.so.2()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libcairo.so.2()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libatk-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libXrandr.so.2()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libXinerama.so.1()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libXfixes.so.3()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libXdamage.so.1()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
--> Processing Dependency: libXcursor.so.1()(64bit) for package: gtk2-2.24.31-1.el7.x86_64
---> Package java-1.8.0-openjdk-headless.x86_64 1:1.8.0.292.b10-1.el7_9 will be installed
--> Processing Dependency: tzdata-java >= 2021a for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: copy-jdk-configs >= 3.3 for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: pcsc-lite-libs(x86-64) for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: lksctp-tools(x86-64) for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64
--> Processing Dependency: jpackage-utils for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64
---> Package libX11.x86_64 0:1.6.7-3.el7_9 will be installed
--> Processing Dependency: libX11-common >= 1.6.7-3.el7_9 for package: libX11-1.6.7-3.el7_9.x86_64
--> Processing Dependency: libxcb.so.1()(64bit) for package: libX11-1.6.7-3.el7_9.x86_64
---> Package libXcomposite.x86_64 0:0.4.4-4.1.el7 will be installed
---> Package libXext.x86_64 0:1.3.3-3.el7 will be installed
---> Package libXi.x86_64 0:1.7.9-1.el7 will be installed
---> Package libXrender.x86_64 0:0.9.10-1.el7 will be installed
---> Package libXtst.x86_64 0:1.2.3-1.el7 will be installed
---> Package libjpeg-turbo.x86_64 0:1.2.90-8.el7 will be installed
---> Package xorg-x11-fonts-Type1.noarch 0:7.5-9.el7 will be installed
--> Processing Dependency: ttmkfdir for package: xorg-x11-fonts-Type1-7.5-9.el7.noarch
--> Processing Dependency: ttmkfdir for package: xorg-x11-fonts-Type1-7.5-9.el7.noarch
--> Running transaction check
---> Package atk.x86_64 0:2.28.1-2.el7 will be installed
---> Package cairo.x86_64 0:1.15.12-4.el7 will be installed
--> Processing Dependency: libpixman-1.so.0()(64bit) for package: cairo-1.15.12-4.el7.x86_64
--> Processing Dependency: libGL.so.1()(64bit) for package: cairo-1.15.12-4.el7.x86_64
--> Processing Dependency: libEGL.so.1()(64bit) for package: cairo-1.15.12-4.el7.x86_64
---> Package copy-jdk-configs.noarch 0:3.3-10.el7_5 will be installed
---> Package cups-libs.x86_64 1:1.6.3-51.el7 will be installed
--> Processing Dependency: libavahi-common.so.3()(64bit) for package: 1:cups-libs-1.6.3-51.el7.x86_64
--> Processing Dependency: libavahi-client.so.3()(64bit) for package: 1:cups-libs-1.6.3-51.el7.x86_64
---> Package gdk-pixbuf2.x86_64 0:2.36.12-3.el7 will be installed
--> Processing Dependency: libjasper.so.1()(64bit) for package: gdk-pixbuf2-2.36.12-3.el7.x86_64
---> Package gtk-update-icon-cache.x86_64 0:3.22.30-6.el7 will be installed
---> Package hicolor-icon-theme.noarch 0:0.12-7.el7 will be installed
---> Package javapackages-tools.noarch 0:3.4.1-11.el7 will be installed
--> Processing Dependency: python-javapackages = 3.4.1-11.el7 for package: javapackages-tools-3.4.1-11.el7.noarch
---> Package libICE.x86_64 0:1.0.9-9.el7 will be installed
---> Package libSM.x86_64 0:1.2.2-2.el7 will be installed
---> Package libX11-common.noarch 0:1.6.7-3.el7_9 will be installed
---> Package libXcursor.x86_64 0:1.1.15-1.el7 will be installed
---> Package libXdamage.x86_64 0:1.1.4-4.1.el7 will be installed
---> Package libXfixes.x86_64 0:5.0.3-1.el7 will be installed
---> Package libXinerama.x86_64 0:1.1.3-2.1.el7 will be installed
---> Package libXrandr.x86_64 0:1.5.1-2.el7 will be installed
---> Package libtiff.x86_64 0:4.0.3-35.el7 will be installed
--> Processing Dependency: libjbig.so.2.0()(64bit) for package: libtiff-4.0.3-35.el7.x86_64
---> Package libxcb.x86_64 0:1.13-1.el7 will be installed
--> Processing Dependency: libXau.so.6()(64bit) for package: libxcb-1.13-1.el7.x86_64
---> Package lksctp-tools.x86_64 0:1.0.17-2.el7 will be installed
---> Package pango.x86_64 0:1.42.4-4.el7_7 will be installed
--> Processing Dependency: libthai(x86-64) >= 0.1.9 for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: libXft(x86-64) >= 2.0.0 for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: harfbuzz(x86-64) >= 1.4.2 for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: fribidi(x86-64) >= 1.0 for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: libthai.so.0(LIBTHAI_0.1)(64bit) for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: libthai.so.0()(64bit) for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: libharfbuzz.so.0()(64bit) for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: libfribidi.so.0()(64bit) for package: pango-1.42.4-4.el7_7.x86_64
--> Processing Dependency: libXft.so.2()(64bit) for package: pango-1.42.4-4.el7_7.x86_64
---> Package pcsc-lite-libs.x86_64 0:1.8.8-8.el7 will be installed
---> Package ttmkfdir.x86_64 0:3.0.9-42.el7 will be installed
---> Package tzdata-java.noarch 0:2021a-1.el7 will be installed
--> Running transaction check
---> Package avahi-libs.x86_64 0:0.6.31-20.el7 will be installed
---> Package fribidi.x86_64 0:1.0.2-1.el7_7.1 will be installed
---> Package harfbuzz.x86_64 0:1.7.5-2.el7 will be installed
--> Processing Dependency: libgraphite2.so.3()(64bit) for package: harfbuzz-1.7.5-2.el7.x86_64
---> Package jasper-libs.x86_64 0:1.900.1-33.el7 will be installed
---> Package jbigkit-libs.x86_64 0:2.0-11.el7 will be installed
---> Package libXau.x86_64 0:1.0.8-2.1.el7 will be installed
---> Package libXft.x86_64 0:2.3.2-2.el7 will be installed
---> Package libglvnd-egl.x86_64 1:1.0.1-0.8.git5baa1e5.el7 will be installed
--> Processing Dependency: libglvnd(x86-64) = 1:1.0.1-0.8.git5baa1e5.el7 for package: 1:libglvnd-egl-1.0.1-0.8.git5baa1e5.el7.x86_64
--> Processing Dependency: mesa-libEGL(x86-64) >= 13.0.4-1 for package: 1:libglvnd-egl-1.0.1-0.8.git5baa1e5.el7.x86_64
--> Processing Dependency: libGLdispatch.so.0()(64bit) for package: 1:libglvnd-egl-1.0.1-0.8.git5baa1e5.el7.x86_64
---> Package libglvnd-glx.x86_64 1:1.0.1-0.8.git5baa1e5.el7 will be installed
--> Processing Dependency: mesa-libGL(x86-64) >= 13.0.4-1 for package: 1:libglvnd-glx-1.0.1-0.8.git5baa1e5.el7.x86_64
---> Package libthai.x86_64 0:0.1.14-9.el7 will be installed
---> Package pixman.x86_64 0:0.34.0-1.el7 will be installed
---> Package python-javapackages.noarch 0:3.4.1-11.el7 will be installed
--> Processing Dependency: python-lxml for package: python-javapackages-3.4.1-11.el7.noarch
--> Running transaction check
---> Package graphite2.x86_64 0:1.3.10-1.el7_3 will be installed
---> Package libglvnd.x86_64 1:1.0.1-0.8.git5baa1e5.el7 will be installed
---> Package mesa-libEGL.x86_64 0:18.3.4-12.el7_9 will be installed
--> Processing Dependency: mesa-libgbm = 18.3.4-12.el7_9 for package: mesa-libEGL-18.3.4-12.el7_9.x86_64
--> Processing Dependency: libxshmfence.so.1()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64
--> Processing Dependency: libwayland-server.so.0()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64
--> Processing Dependency: libwayland-client.so.0()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64
--> Processing Dependency: libglapi.so.0()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64
--> Processing Dependency: libgbm.so.1()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64
---> Package mesa-libGL.x86_64 0:18.3.4-12.el7_9 will be installed
--> Processing Dependency: libXxf86vm.so.1()(64bit) for package: mesa-libGL-18.3.4-12.el7_9.x86_64
---> Package python-lxml.x86_64 0:3.2.1-4.el7 will be installed
--> Running transaction check
---> Package libXxf86vm.x86_64 0:1.1.4-1.el7 will be installed
---> Package libwayland-client.x86_64 0:1.15.0-1.el7 will be installed
---> Package libwayland-server.x86_64 0:1.15.0-1.el7 will be installed
---> Package libxshmfence.x86_64 0:1.2-1.el7 will be installed
---> Package mesa-libgbm.x86_64 0:18.3.4-12.el7_9 will be installed
---> Package mesa-libglapi.x86_64 0:18.3.4-12.el7_9 will be installed
--> Finished Dependency Resolution
……

3、 下载安装elk

[root@CentOS7 elk]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.8.1-x86_64.rpm
--2021-07-09 14:34:16-- https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.8.1-x86_64.rpm
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 318401743 (304M) [application/octet-stream]
Saving to: ‘elasticsearch-7.8.1-x86_64.rpm’
 
100%[==================================================================================================================>] 318,401,743 7.92MB/s   in 44s
 
2021-07-09 14:35:01 (6.89 MB/s) - ‘elasticsearch-7.8.1-x86_64.rpm’ saved [318401743/318401743]
 
[root@CentOS7 elk]# wget https://artifacts.elastic.co/downloads/kibana/kibana-7.8.1-x86_64.rpm
--2021-07-09 14:35:44-- https://artifacts.elastic.co/downloads/kibana/kibana-7.8.1-x86_64.rpm
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 347916016 (332M) [application/octet-stream]
Saving to: ‘kibana-7.8.1-x86_64.rpm’
 
100%[==================================================================================================================>] 347,916,016 6.86MB/s   in 47s
 
2021-07-09 14:36:31 (7.09 MB/s) - ‘kibana-7.8.1-x86_64.rpm’ saved [347916016/347916016]
 
[root@CentOS7 elk]# wget https://artifacts.elastic.co/downloads/logstash/logstash-7.8.1.rpm
--2021-07-09 14:36:58-- https://artifacts.elastic.co/downloads/logstash/logstash-7.8.1.rpm
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 159752536 (152M) [application/octet-stream]
Saving to: ‘logstash-7.8.1.rpm’
 
100%[==================================================================================================================>] 159,752,536 9.29MB/s   in 18s
 
2021-07-09 14:37:17 (8.37 MB/s) - ‘logstash-7.8.1.rpm’ saved [159752536/159752536]
 
 
[root@elastiflow ~]# rpm -ivh elasticsearch-7.8.1-x86_64.rpm kibana-7.8.1-x86_64.rpm logstash-7.8.1.rpm
warning: elasticsearch-7.8.1-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing...                          ################################# [100%]
Updating / installing...
  1:logstash-1:7.8.1-1              ################################# [ 33%]
Using provided startup.options file: /etc/logstash/startup.options
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated
Successfully created system startup script for Logstash
  2:kibana-7.8.1-1                  ################################# [ 67%]
Creating elasticsearch group... OK
Creating elasticsearch user... OK
  3:elasticsearch-0:7.8.1-1         ################################# [100%]
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service
Created elasticsearch keystore in /etc/elasticsearch/elasticsearch.keystore

?

4、 配置启动服务

[root@elastiflow ~]# systemctl daemon-reload
[root@elastiflow ~]# systemctl enable elasticsearch.service
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
[root@elastiflow ~]# systemctl enable kibana.service
Created symlink from /etc/systemd/system/multi-user.target.wants/kibana.service to /etc/systemd/system/kibana.service.
[root@elastiflow ~]# systemctl enable logstash.service
Created symlink from /etc/systemd/system/multi-user.target.wants/logstash.service to /etc/systemd/system/logstash.service.

?5、 修改ES配置文件 vim /etc/elasticsearch/elasticsearch.yml

CentOS7 部署ElastiFlow网络流量分析平台

6、 修改jvm内存vim /etc/elasticsearch/jvm.options

CentOS7 部署ElastiFlow网络流量分析平台

7、 修改kibana配置 vim /etc/kibana/kibana.yml

?CentOS7 部署ElastiFlow网络流量分析平台

8、 重启服务

[root@elastiflow ~]# systemctl restart elasticsearch.service
[root@elastiflow ~]# systemctl restart kibana.service

?9、 安装logstash模块

[root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-codec-sflow
Validating logstash-codec-sflow
Installing logstash-codec-sflow
Installation successful
 [root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-codec-netflow
Validating logstash-codec-netflow
Installing logstash-codec-netflow
Installation successful
[root@CentOS7 ~]#
[root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-input-udp
Validating logstash-input-udp
Installing logstash-input-udp
Installation successful
[root@CentOS7 ~]#
[root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-input-tcp
Validating logstash-input-tcp
Installing logstash-input-tcp
Installation successful
[root@CentOS7 ~]#
[root@CentOS7 ~]#
[root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-filter-dns
Validating logstash-filter-dns
Installing logstash-filter-dns
Installation successful
[root@CentOS7 ~]#
[root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-filter-geoip
Validating logstash-filter-geoip
Installing logstash-filter-geoip
Installation successful
[root@CentOS7 ~]#
[root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-filter-translate
Validating logstash-filter-translate
Installing logstash-filter-translate
Installation successful

?10、????? 安装ElastiFlow

[root@CentOS7 tmp]# git clone https://github.com/robcowart/elastiflow.git
Cloning into ‘elastiflow‘...
remote: Enumerating objects: 2234, done.
remote: Counting objects: 100% (38/38), done.
remote: Compressing objects: 100% (36/36), done.
Receiving objects:  60% (1351/2234), 510.03 MiB | 2.54 MiB/s
 
remote: Total 2234 (delta 16), reused 7 (delta 1), pack-reused 2196
Receiving objects: 100% (2234/2234), 1003.24 MiB | 3.76 MiB/s, done.
Resolving deltas: 100% (1259/1259), done.
 
[root@CentOS7 tmp]# cp -a elastiflow/logstash/elastiflow/. /etc/logstash/elastiflow/
[root@CentOS7 tmp]#
[root@CentOS7 tmp]#
[root@CentOS7 tmp]# cp -a elastiflow/logstash.service.d/. /etc/systemd/system/logstash.service.d/
 
[root@elastiflow ~]# /usr/share/logstash/bin/system-install
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated
Successfully created system startup script for Logstash

?11、????? 重启logstash服务

[root@elastiflow ~]# systemctl daemon-reload
[root@elastiflow ~]# systemctl enable logstash
[root@elastiflow ~]# systemctl start logstash
[root@elastiflow ~]# systemctl restart logstash

?12、????? 导入kibana模板

[root@elastiflow ~]# ls elastiflow-master/kibana/
elastiflow.kibana.7.8.x.ndjson

?CentOS7 部署ElastiFlow网络流量分析平台?

13、????? 完成

14、????? Cisco c2600配置

r2621#conf t
r2621(config)#int e0/0
r2621(config-if)#ip route-cache flow
r2621(config-if)#exit
r2621(config)#ip flow-export destination 10.2**.128.129 2055
r2621(config)#ip flow-export source e0/0
r2621(config)#ip flow-export version 5
r2621(config)#ip flow-cache timeout active 1
r2621(config)#ip flow-cache timeout inactive 15
r2621(config)#exit
r2621#write

15、 使用snmp获取端口描述信息

[root@elastiflow user_settings]# snmpwalk 10.2**.32.34 -v 2c -c Qu_nquda0 ifDescr
IF-MIB::ifDescr.1 = STRING: TenGigabitEthernet0/0/0
IF-MIB::ifDescr.2 = STRING: TenGigabitEthernet0/0/1
IF-MIB::ifDescr.3 = STRING: GigabitEthernet0/0/0
IF-MIB::ifDescr.4 = STRING: GigabitEthernet0/0/1
IF-MIB::ifDescr.5 = STRING: GigabitEthernet0/0/2
IF-MIB::ifDescr.6 = STRING: GigabitEthernet0/0/3
IF-MIB::ifDescr.7 = STRING: GigabitEthernet0/0/4
IF-MIB::ifDescr.8 = STRING: GigabitEthernet0/0/5
IF-MIB::ifDescr.9 = STRING: Crypto-Engine0/0/8
IF-MIB::ifDescr.10 = STRING: GigabitEthernet0
IF-MIB::ifDescr.11 = STRING: VoIP-Null0
IF-MIB::ifDescr.12 = STRING: Null0
IF-MIB::ifDescr.14 = STRING: GigabitEthernet0/0/1.102
IF-MIB::ifDescr.15 = STRING: GigabitEthernet0/0/1.103
IF-MIB::ifDescr.17 = STRING: GigabitEthernet0/0/1.105
IF-MIB::ifDescr.18 = STRING: GigabitEthernet0/0/1.106
IF-MIB::ifDescr.19 = STRING: GigabitEthernet0/0/1.107
IF-MIB::ifDescr.20 = STRING: GigabitEthernet0/0/1.108
IF-MIB::ifDescr.21 = STRING: GigabitEthernet0/0/1.109
IF-MIB::ifDescr.22 = STRING: GigabitEthernet0/0/1.110
IF-MIB::ifDescr.23 = STRING: GigabitEthernet0/0/1.111
IF-MIB::ifDescr.26 = STRING: GigabitEthernet0/0/1.100
[root@elastiflow user_settings]# snmpwalk 10.2**.32.34 -v 2c -c Qu_nquda0 ifIndex
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifIndex.2 = INTEGER: 2
IF-MIB::ifIndex.3 = INTEGER: 3
IF-MIB::ifIndex.4 = INTEGER: 4
IF-MIB::ifIndex.5 = INTEGER: 5
IF-MIB::ifIndex.6 = INTEGER: 6
IF-MIB::ifIndex.7 = INTEGER: 7
IF-MIB::ifIndex.8 = INTEGER: 8
IF-MIB::ifIndex.9 = INTEGER: 9
IF-MIB::ifIndex.10 = INTEGER: 10
IF-MIB::ifIndex.11 = INTEGER: 11
IF-MIB::ifIndex.12 = INTEGER: 12
IF-MIB::ifIndex.14 = INTEGER: 14
IF-MIB::ifIndex.15 = INTEGER: 15
IF-MIB::ifIndex.17 = INTEGER: 17
IF-MIB::ifIndex.18 = INTEGER: 18
IF-MIB::ifIndex.19 = INTEGER: 19
IF-MIB::ifIndex.20 = INTEGER: 20
IF-MIB::ifIndex.21 = INTEGER: 21
IF-MIB::ifIndex.22 = INTEGER: 22
IF-MIB::ifIndex.23 = INTEGER: 23
IF-MIB::ifIndex.26 = INTEGER: 26

16、修改/etc/logstash/elastiflow/user_settings/ifName.yml

[root@elastiflow ~]# cat /etc/logstash/elastiflow/user_settings/ifName.yml
"192.0.2.11::ifName.2": "eth0"
"10.2**.240.143::ifName.1": "wan123"
#10.2**.4.135 desc
"10.2**.4.138::ifName.1": "Embedded-Service-Engine0/0"
"10.2**.4.138::ifName.2": "GigabitEthernet0/0"


#10.2**.32.34 desc
"10.2**.32.34::ifName.1": "TenGigabitEthernet0/0/0"
"10.2**.32.34::ifName.2": "TenGigabitEthernet0/0/1"
"10.2**.32.34::ifName.3": "GigabitEthernet0/0/0"
"10.2**.32.34::ifName.4": "GigabitEthernet0/0/1"
"10.2**.32.34::ifName.5": "GigabitEthernet0/0/2"
"10.2**.32.34::ifName.6": "GigabitEthernet0/0/3"
上一篇:cmake 禁止 4819 警告


下一篇:设计模式 - 工厂方法