1、 调整系统内核参数
[root@elastiflow sysctl.d]# cat 100-elastiflow.conf net.core.netdev_max_backlog=4096 net.core.rmem_default=262144 net.core.rmem_max=67108864 net.ipv4.udp_rmem_min=131072 net.ipv4.udp_mem=2097152 4194304 8388608 #less 75000 nodes net.core.netdev_max_backlog=4096 net.core.rmem_default=262144 net.core.rmem_max=67108864 net.ipv4.udp_rmem_min=131072 net.ipv4.udp_mem=2097152 4194304 8388608 #more then 75000 nodes net.core.netdev_max_backlog=8192 net.core.rmem_default=262144 net.core.rmem_max=134217728 net.ipv4.udp_rmem_min=131072 net.ipv4.udp_mem=4194304 8388608 16777216
2、 安装java环境
[root@elastiflow yum.repos.d]# yum install java-openjdk-devel java-openjdk Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile No package java-openjdk-devel available. Resolving Dependencies --> Running transaction check ---> Package java-1.8.0-openjdk.x86_64 1:1.8.0.292.b10-1.el7_9 will be installed --> Processing Dependency: java-1.8.0-openjdk-headless(x86-64) = 1:1.8.0.292.b10-1.el7_9 for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: xorg-x11-fonts-Type1 for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libjvm.so(SUNWprivate_1.1)(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libjpeg.so.62(LIBJPEG_6.2)(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libjava.so(SUNWprivate_1.1)(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libXcomposite(x86-64) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: gtk2(x86-64) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libjvm.so()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libjpeg.so.62()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libjava.so()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libgif.so.4()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libXtst.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libXrender.so.1()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libXi.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libXext.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: libX11.so.6()(64bit) for package: 1:java-1.8.0-openjdk-1.8.0.292.b10-1.el7_9.x86_64 --> Running transaction check ---> Package giflib.x86_64 0:4.1.6-9.el7 will be installed --> Processing Dependency: libSM.so.6()(64bit) for package: giflib-4.1.6-9.el7.x86_64 --> Processing Dependency: libICE.so.6()(64bit) for package: giflib-4.1.6-9.el7.x86_64 ---> Package gtk2.x86_64 0:2.24.31-1.el7 will be installed --> Processing Dependency: pango >= 1.20.0-1 for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libtiff >= 3.6.1 for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libXrandr >= 1.2.99.4-2 for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: atk >= 1.29.4-2 for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: hicolor-icon-theme for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: gtk-update-icon-cache for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libpangoft2-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libpangocairo-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libpango-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libgdk_pixbuf-2.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libcups.so.2()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libcairo.so.2()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libatk-1.0.so.0()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libXrandr.so.2()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libXinerama.so.1()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libXfixes.so.3()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libXdamage.so.1()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 --> Processing Dependency: libXcursor.so.1()(64bit) for package: gtk2-2.24.31-1.el7.x86_64 ---> Package java-1.8.0-openjdk-headless.x86_64 1:1.8.0.292.b10-1.el7_9 will be installed --> Processing Dependency: tzdata-java >= 2021a for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: copy-jdk-configs >= 3.3 for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: pcsc-lite-libs(x86-64) for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: lksctp-tools(x86-64) for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64 --> Processing Dependency: jpackage-utils for package: 1:java-1.8.0-openjdk-headless-1.8.0.292.b10-1.el7_9.x86_64 ---> Package libX11.x86_64 0:1.6.7-3.el7_9 will be installed --> Processing Dependency: libX11-common >= 1.6.7-3.el7_9 for package: libX11-1.6.7-3.el7_9.x86_64 --> Processing Dependency: libxcb.so.1()(64bit) for package: libX11-1.6.7-3.el7_9.x86_64 ---> Package libXcomposite.x86_64 0:0.4.4-4.1.el7 will be installed ---> Package libXext.x86_64 0:1.3.3-3.el7 will be installed ---> Package libXi.x86_64 0:1.7.9-1.el7 will be installed ---> Package libXrender.x86_64 0:0.9.10-1.el7 will be installed ---> Package libXtst.x86_64 0:1.2.3-1.el7 will be installed ---> Package libjpeg-turbo.x86_64 0:1.2.90-8.el7 will be installed ---> Package xorg-x11-fonts-Type1.noarch 0:7.5-9.el7 will be installed --> Processing Dependency: ttmkfdir for package: xorg-x11-fonts-Type1-7.5-9.el7.noarch --> Processing Dependency: ttmkfdir for package: xorg-x11-fonts-Type1-7.5-9.el7.noarch --> Running transaction check ---> Package atk.x86_64 0:2.28.1-2.el7 will be installed ---> Package cairo.x86_64 0:1.15.12-4.el7 will be installed --> Processing Dependency: libpixman-1.so.0()(64bit) for package: cairo-1.15.12-4.el7.x86_64 --> Processing Dependency: libGL.so.1()(64bit) for package: cairo-1.15.12-4.el7.x86_64 --> Processing Dependency: libEGL.so.1()(64bit) for package: cairo-1.15.12-4.el7.x86_64 ---> Package copy-jdk-configs.noarch 0:3.3-10.el7_5 will be installed ---> Package cups-libs.x86_64 1:1.6.3-51.el7 will be installed --> Processing Dependency: libavahi-common.so.3()(64bit) for package: 1:cups-libs-1.6.3-51.el7.x86_64 --> Processing Dependency: libavahi-client.so.3()(64bit) for package: 1:cups-libs-1.6.3-51.el7.x86_64 ---> Package gdk-pixbuf2.x86_64 0:2.36.12-3.el7 will be installed --> Processing Dependency: libjasper.so.1()(64bit) for package: gdk-pixbuf2-2.36.12-3.el7.x86_64 ---> Package gtk-update-icon-cache.x86_64 0:3.22.30-6.el7 will be installed ---> Package hicolor-icon-theme.noarch 0:0.12-7.el7 will be installed ---> Package javapackages-tools.noarch 0:3.4.1-11.el7 will be installed --> Processing Dependency: python-javapackages = 3.4.1-11.el7 for package: javapackages-tools-3.4.1-11.el7.noarch ---> Package libICE.x86_64 0:1.0.9-9.el7 will be installed ---> Package libSM.x86_64 0:1.2.2-2.el7 will be installed ---> Package libX11-common.noarch 0:1.6.7-3.el7_9 will be installed ---> Package libXcursor.x86_64 0:1.1.15-1.el7 will be installed ---> Package libXdamage.x86_64 0:1.1.4-4.1.el7 will be installed ---> Package libXfixes.x86_64 0:5.0.3-1.el7 will be installed ---> Package libXinerama.x86_64 0:1.1.3-2.1.el7 will be installed ---> Package libXrandr.x86_64 0:1.5.1-2.el7 will be installed ---> Package libtiff.x86_64 0:4.0.3-35.el7 will be installed --> Processing Dependency: libjbig.so.2.0()(64bit) for package: libtiff-4.0.3-35.el7.x86_64 ---> Package libxcb.x86_64 0:1.13-1.el7 will be installed --> Processing Dependency: libXau.so.6()(64bit) for package: libxcb-1.13-1.el7.x86_64 ---> Package lksctp-tools.x86_64 0:1.0.17-2.el7 will be installed ---> Package pango.x86_64 0:1.42.4-4.el7_7 will be installed --> Processing Dependency: libthai(x86-64) >= 0.1.9 for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: libXft(x86-64) >= 2.0.0 for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: harfbuzz(x86-64) >= 1.4.2 for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: fribidi(x86-64) >= 1.0 for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: libthai.so.0(LIBTHAI_0.1)(64bit) for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: libthai.so.0()(64bit) for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: libharfbuzz.so.0()(64bit) for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: libfribidi.so.0()(64bit) for package: pango-1.42.4-4.el7_7.x86_64 --> Processing Dependency: libXft.so.2()(64bit) for package: pango-1.42.4-4.el7_7.x86_64 ---> Package pcsc-lite-libs.x86_64 0:1.8.8-8.el7 will be installed ---> Package ttmkfdir.x86_64 0:3.0.9-42.el7 will be installed ---> Package tzdata-java.noarch 0:2021a-1.el7 will be installed --> Running transaction check ---> Package avahi-libs.x86_64 0:0.6.31-20.el7 will be installed ---> Package fribidi.x86_64 0:1.0.2-1.el7_7.1 will be installed ---> Package harfbuzz.x86_64 0:1.7.5-2.el7 will be installed --> Processing Dependency: libgraphite2.so.3()(64bit) for package: harfbuzz-1.7.5-2.el7.x86_64 ---> Package jasper-libs.x86_64 0:1.900.1-33.el7 will be installed ---> Package jbigkit-libs.x86_64 0:2.0-11.el7 will be installed ---> Package libXau.x86_64 0:1.0.8-2.1.el7 will be installed ---> Package libXft.x86_64 0:2.3.2-2.el7 will be installed ---> Package libglvnd-egl.x86_64 1:1.0.1-0.8.git5baa1e5.el7 will be installed --> Processing Dependency: libglvnd(x86-64) = 1:1.0.1-0.8.git5baa1e5.el7 for package: 1:libglvnd-egl-1.0.1-0.8.git5baa1e5.el7.x86_64 --> Processing Dependency: mesa-libEGL(x86-64) >= 13.0.4-1 for package: 1:libglvnd-egl-1.0.1-0.8.git5baa1e5.el7.x86_64 --> Processing Dependency: libGLdispatch.so.0()(64bit) for package: 1:libglvnd-egl-1.0.1-0.8.git5baa1e5.el7.x86_64 ---> Package libglvnd-glx.x86_64 1:1.0.1-0.8.git5baa1e5.el7 will be installed --> Processing Dependency: mesa-libGL(x86-64) >= 13.0.4-1 for package: 1:libglvnd-glx-1.0.1-0.8.git5baa1e5.el7.x86_64 ---> Package libthai.x86_64 0:0.1.14-9.el7 will be installed ---> Package pixman.x86_64 0:0.34.0-1.el7 will be installed ---> Package python-javapackages.noarch 0:3.4.1-11.el7 will be installed --> Processing Dependency: python-lxml for package: python-javapackages-3.4.1-11.el7.noarch --> Running transaction check ---> Package graphite2.x86_64 0:1.3.10-1.el7_3 will be installed ---> Package libglvnd.x86_64 1:1.0.1-0.8.git5baa1e5.el7 will be installed ---> Package mesa-libEGL.x86_64 0:18.3.4-12.el7_9 will be installed --> Processing Dependency: mesa-libgbm = 18.3.4-12.el7_9 for package: mesa-libEGL-18.3.4-12.el7_9.x86_64 --> Processing Dependency: libxshmfence.so.1()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64 --> Processing Dependency: libwayland-server.so.0()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64 --> Processing Dependency: libwayland-client.so.0()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64 --> Processing Dependency: libglapi.so.0()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64 --> Processing Dependency: libgbm.so.1()(64bit) for package: mesa-libEGL-18.3.4-12.el7_9.x86_64 ---> Package mesa-libGL.x86_64 0:18.3.4-12.el7_9 will be installed --> Processing Dependency: libXxf86vm.so.1()(64bit) for package: mesa-libGL-18.3.4-12.el7_9.x86_64 ---> Package python-lxml.x86_64 0:3.2.1-4.el7 will be installed --> Running transaction check ---> Package libXxf86vm.x86_64 0:1.1.4-1.el7 will be installed ---> Package libwayland-client.x86_64 0:1.15.0-1.el7 will be installed ---> Package libwayland-server.x86_64 0:1.15.0-1.el7 will be installed ---> Package libxshmfence.x86_64 0:1.2-1.el7 will be installed ---> Package mesa-libgbm.x86_64 0:18.3.4-12.el7_9 will be installed ---> Package mesa-libglapi.x86_64 0:18.3.4-12.el7_9 will be installed --> Finished Dependency Resolution ……
3、 下载安装elk
[root@CentOS7 elk]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.8.1-x86_64.rpm --2021-07-09 14:34:16-- https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.8.1-x86_64.rpm Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7:: Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 318401743 (304M) [application/octet-stream] Saving to: ‘elasticsearch-7.8.1-x86_64.rpm’ 100%[==================================================================================================================>] 318,401,743 7.92MB/s in 44s 2021-07-09 14:35:01 (6.89 MB/s) - ‘elasticsearch-7.8.1-x86_64.rpm’ saved [318401743/318401743] [root@CentOS7 elk]# wget https://artifacts.elastic.co/downloads/kibana/kibana-7.8.1-x86_64.rpm --2021-07-09 14:35:44-- https://artifacts.elastic.co/downloads/kibana/kibana-7.8.1-x86_64.rpm Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7:: Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 347916016 (332M) [application/octet-stream] Saving to: ‘kibana-7.8.1-x86_64.rpm’ 100%[==================================================================================================================>] 347,916,016 6.86MB/s in 47s 2021-07-09 14:36:31 (7.09 MB/s) - ‘kibana-7.8.1-x86_64.rpm’ saved [347916016/347916016] [root@CentOS7 elk]# wget https://artifacts.elastic.co/downloads/logstash/logstash-7.8.1.rpm --2021-07-09 14:36:58-- https://artifacts.elastic.co/downloads/logstash/logstash-7.8.1.rpm Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7:: Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 159752536 (152M) [application/octet-stream] Saving to: ‘logstash-7.8.1.rpm’ 100%[==================================================================================================================>] 159,752,536 9.29MB/s in 18s 2021-07-09 14:37:17 (8.37 MB/s) - ‘logstash-7.8.1.rpm’ saved [159752536/159752536] [root@elastiflow ~]# rpm -ivh elasticsearch-7.8.1-x86_64.rpm kibana-7.8.1-x86_64.rpm logstash-7.8.1.rpm warning: elasticsearch-7.8.1-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY Preparing... ################################# [100%] Updating / installing... 1:logstash-1:7.8.1-1 ################################# [ 33%] Using provided startup.options file: /etc/logstash/startup.options /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated Successfully created system startup script for Logstash 2:kibana-7.8.1-1 ################################# [ 67%] Creating elasticsearch group... OK Creating elasticsearch user... OK 3:elasticsearch-0:7.8.1-1 ################################# [100%] ### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd sudo systemctl daemon-reload sudo systemctl enable elasticsearch.service ### You can start elasticsearch service by executing sudo systemctl start elasticsearch.service Created elasticsearch keystore in /etc/elasticsearch/elasticsearch.keystore
?
4、 配置启动服务
[root@elastiflow ~]# systemctl daemon-reload [root@elastiflow ~]# systemctl enable elasticsearch.service Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service. [root@elastiflow ~]# systemctl enable kibana.service Created symlink from /etc/systemd/system/multi-user.target.wants/kibana.service to /etc/systemd/system/kibana.service. [root@elastiflow ~]# systemctl enable logstash.service Created symlink from /etc/systemd/system/multi-user.target.wants/logstash.service to /etc/systemd/system/logstash.service.
?5、 修改ES配置文件 vim /etc/elasticsearch/elasticsearch.yml
6、 修改jvm内存vim /etc/elasticsearch/jvm.options
7、 修改kibana配置 vim /etc/kibana/kibana.yml
?
8、 重启服务
[root@elastiflow ~]# systemctl restart elasticsearch.service [root@elastiflow ~]# systemctl restart kibana.service
?9、 安装logstash模块
[root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-codec-sflow Validating logstash-codec-sflow Installing logstash-codec-sflow Installation successful [root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-codec-netflow Validating logstash-codec-netflow Installing logstash-codec-netflow Installation successful [root@CentOS7 ~]# [root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-input-udp Validating logstash-input-udp Installing logstash-input-udp Installation successful [root@CentOS7 ~]# [root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-input-tcp Validating logstash-input-tcp Installing logstash-input-tcp Installation successful [root@CentOS7 ~]# [root@CentOS7 ~]# [root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-filter-dns Validating logstash-filter-dns Installing logstash-filter-dns Installation successful [root@CentOS7 ~]# [root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-filter-geoip Validating logstash-filter-geoip Installing logstash-filter-geoip Installation successful [root@CentOS7 ~]# [root@CentOS7 ~]# /usr/share/logstash/bin/logstash-plugin install logstash-filter-translate Validating logstash-filter-translate Installing logstash-filter-translate Installation successful
?10、????? 安装ElastiFlow
[root@CentOS7 tmp]# git clone https://github.com/robcowart/elastiflow.git Cloning into ‘elastiflow‘... remote: Enumerating objects: 2234, done. remote: Counting objects: 100% (38/38), done. remote: Compressing objects: 100% (36/36), done. Receiving objects: 60% (1351/2234), 510.03 MiB | 2.54 MiB/s remote: Total 2234 (delta 16), reused 7 (delta 1), pack-reused 2196 Receiving objects: 100% (2234/2234), 1003.24 MiB | 3.76 MiB/s, done. Resolving deltas: 100% (1259/1259), done. [root@CentOS7 tmp]# cp -a elastiflow/logstash/elastiflow/. /etc/logstash/elastiflow/ [root@CentOS7 tmp]# [root@CentOS7 tmp]# [root@CentOS7 tmp]# cp -a elastiflow/logstash.service.d/. /etc/systemd/system/logstash.service.d/ [root@elastiflow ~]# /usr/share/logstash/bin/system-install /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated Successfully created system startup script for Logstash
?11、????? 重启logstash服务
[root@elastiflow ~]# systemctl daemon-reload [root@elastiflow ~]# systemctl enable logstash [root@elastiflow ~]# systemctl start logstash [root@elastiflow ~]# systemctl restart logstash
?12、????? 导入kibana模板
[root@elastiflow ~]# ls elastiflow-master/kibana/ elastiflow.kibana.7.8.x.ndjson
??
13、????? 完成
14、????? Cisco c2600配置
r2621#conf t r2621(config)#int e0/0 r2621(config-if)#ip route-cache flow r2621(config-if)#exit r2621(config)#ip flow-export destination 10.2**.128.129 2055 r2621(config)#ip flow-export source e0/0 r2621(config)#ip flow-export version 5 r2621(config)#ip flow-cache timeout active 1 r2621(config)#ip flow-cache timeout inactive 15 r2621(config)#exit r2621#write
15、 使用snmp获取端口描述信息
[root@elastiflow user_settings]# snmpwalk 10.2**.32.34 -v 2c -c Qu_nquda0 ifDescr IF-MIB::ifDescr.1 = STRING: TenGigabitEthernet0/0/0 IF-MIB::ifDescr.2 = STRING: TenGigabitEthernet0/0/1 IF-MIB::ifDescr.3 = STRING: GigabitEthernet0/0/0 IF-MIB::ifDescr.4 = STRING: GigabitEthernet0/0/1 IF-MIB::ifDescr.5 = STRING: GigabitEthernet0/0/2 IF-MIB::ifDescr.6 = STRING: GigabitEthernet0/0/3 IF-MIB::ifDescr.7 = STRING: GigabitEthernet0/0/4 IF-MIB::ifDescr.8 = STRING: GigabitEthernet0/0/5 IF-MIB::ifDescr.9 = STRING: Crypto-Engine0/0/8 IF-MIB::ifDescr.10 = STRING: GigabitEthernet0 IF-MIB::ifDescr.11 = STRING: VoIP-Null0 IF-MIB::ifDescr.12 = STRING: Null0 IF-MIB::ifDescr.14 = STRING: GigabitEthernet0/0/1.102 IF-MIB::ifDescr.15 = STRING: GigabitEthernet0/0/1.103 IF-MIB::ifDescr.17 = STRING: GigabitEthernet0/0/1.105 IF-MIB::ifDescr.18 = STRING: GigabitEthernet0/0/1.106 IF-MIB::ifDescr.19 = STRING: GigabitEthernet0/0/1.107 IF-MIB::ifDescr.20 = STRING: GigabitEthernet0/0/1.108 IF-MIB::ifDescr.21 = STRING: GigabitEthernet0/0/1.109 IF-MIB::ifDescr.22 = STRING: GigabitEthernet0/0/1.110 IF-MIB::ifDescr.23 = STRING: GigabitEthernet0/0/1.111 IF-MIB::ifDescr.26 = STRING: GigabitEthernet0/0/1.100 [root@elastiflow user_settings]# snmpwalk 10.2**.32.34 -v 2c -c Qu_nquda0 ifIndex IF-MIB::ifIndex.1 = INTEGER: 1 IF-MIB::ifIndex.2 = INTEGER: 2 IF-MIB::ifIndex.3 = INTEGER: 3 IF-MIB::ifIndex.4 = INTEGER: 4 IF-MIB::ifIndex.5 = INTEGER: 5 IF-MIB::ifIndex.6 = INTEGER: 6 IF-MIB::ifIndex.7 = INTEGER: 7 IF-MIB::ifIndex.8 = INTEGER: 8 IF-MIB::ifIndex.9 = INTEGER: 9 IF-MIB::ifIndex.10 = INTEGER: 10 IF-MIB::ifIndex.11 = INTEGER: 11 IF-MIB::ifIndex.12 = INTEGER: 12 IF-MIB::ifIndex.14 = INTEGER: 14 IF-MIB::ifIndex.15 = INTEGER: 15 IF-MIB::ifIndex.17 = INTEGER: 17 IF-MIB::ifIndex.18 = INTEGER: 18 IF-MIB::ifIndex.19 = INTEGER: 19 IF-MIB::ifIndex.20 = INTEGER: 20 IF-MIB::ifIndex.21 = INTEGER: 21 IF-MIB::ifIndex.22 = INTEGER: 22 IF-MIB::ifIndex.23 = INTEGER: 23 IF-MIB::ifIndex.26 = INTEGER: 26
16、修改/etc/logstash/elastiflow/user_settings/ifName.yml
[root@elastiflow ~]# cat /etc/logstash/elastiflow/user_settings/ifName.yml "192.0.2.11::ifName.2": "eth0" "10.2**.240.143::ifName.1": "wan123" #10.2**.4.135 desc "10.2**.4.138::ifName.1": "Embedded-Service-Engine0/0" "10.2**.4.138::ifName.2": "GigabitEthernet0/0" #10.2**.32.34 desc "10.2**.32.34::ifName.1": "TenGigabitEthernet0/0/0" "10.2**.32.34::ifName.2": "TenGigabitEthernet0/0/1" "10.2**.32.34::ifName.3": "GigabitEthernet0/0/0" "10.2**.32.34::ifName.4": "GigabitEthernet0/0/1" "10.2**.32.34::ifName.5": "GigabitEthernet0/0/2" "10.2**.32.34::ifName.6": "GigabitEthernet0/0/3"