Frostmourne (霜之哀伤) ELK日志告警系统部署教程

本文最后更新于 2024年7月2日 下午

简介

Frostmourne(霜之哀伤)是汽车之家经销商技术部监控系统的开源版本，用于帮助监控几乎所有数据库数据(包括Elasticsearch, Prometheus, SkyWalking, MySql 等等)。如果你已经建立起了日志系统， 指标体系，却苦恼于没有一个配套监控系统，也许它能帮到你。

支持数据源：Elasticsearch, HTTP, SkyWalking, Prometheus, InfluxDB, MySQL/TiDb, ClickHouse, SqlServer, PING, IotDB, Telnet

支持告警发送方式：钉钉(机器人)、企业微信(机器人)、飞书机器人、OneMessage机器人、Email、短信、HTTP。（text, markdown）

支持LDAP认证和自动创建用户。

Elasticsearch数据查询、分享和下载

报警消息抑制功能，防止消息轰炸；也有报警升级功能，避免故障相关方长时间得不到通知。

Github地址：https://github.com/AutohomeCorp/frostmourne

环境要求：JAVA8-14、Mysql 8数据库。

教程使用Linux版本：Rocky Linux 8 （关闭SELinux）

数据库使用Mysql 8.0

版本：部署1.0版本

注意：目前不支持ES8 的加密认证，需要等后期支持JAVA 17。

使用ZIP包部署（使用Linux环境）

下载JDK（推荐使用JDK8）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

dnf install wget tree
## 安装wget tree

cd /opt
mkdir java1.8
cd /opt/java1.8
wget --execute robots=off -nc -nd -r -l1 -A '*.gz' https://mirrors.tuna.tsinghua.edu.cn/Adoptium/8/jdk/x64/linux/
## 下载OpenJDK8二进制包，源为清华大学源，会自动下载最新版。

tar -zxvf OpenJDK8U-jdk_*.tar.gz 
## 解压

tree -L 2 /opt/java1.8/
/opt/java1.8/
├── jdk8u412-b08
│   ├── ASSEMBLY_EXCEPTION
│   ├── bin
│   ├── include
│   ├── jre
│   ├── lib
│   ├── LICENSE
│   ├── man
│   ├── NOTICE
│   ├── release
│   ├── sample
│   ├── src.zip
│   └── THIRD_PARTY_README
└── OpenJDK8U-jdk_x64_linux_hotspot_8u362b09.tar.gz

7 directories, 7 files


## 查看当前文件树

PS：JDK也可以手动去https://mirrors.tuna.tsinghua.edu.cn/Adoptium/8/jdk/x64/linux/ 目录下进行下载最新版。

部署Mysql（建议为8版本）

1
2
3
4
5
6
7
8
9
10
dnf install mysql-server

##Rocky 8源默认安装mysql8

systemctl enable --now mysqld

systemctl status mysqld.service 

## 设置开机并启动，查看启动状态

参数修改

vim /etc/my.cnf.d/mysql-server.cnf

1
2
3
4
5
6
7

[mysqld]
default-time-zone = '+8:00'

max_connections = 300


PS：default-time-zone不配置可能有夏令时问题。 https://blog.csdn.net/cm15835106905/article/details/124676257

初始化

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
mysql_secure_installation 

## 初始化Mysql


## 如下，都选择Y即可，密码等级选择0，然后配置root密码。


Securing the MySQL server deployment.

Connecting to MySQL using a blank password.

VALIDATE PASSWORD COMPONENT can be used to test passwords
and improve security. It checks the strength of password
and allows the users to set only those passwords which are
secure enough. Would you like to setup VALIDATE PASSWORD component?

Press y|Y for Yes, any other key for No: y

There are three levels of password validation policy:

LOW    Length >= 8
MEDIUM Length >= 8, numeric, mixed case, and special characters
STRONG Length >= 8, numeric, mixed case, special characters and dictionary                  file

Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: 0
Please set the password for root here.

New password: 

Re-enter new password: 

Estimated strength of the password: 50 
Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : y
By default, a MySQL installation has an anonymous user,
allowing anyone to log into MySQL without having to have
a user account created for them. This is intended only for
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production
environment.

Remove anonymous users? (Press y|Y for Yes, any other key for No) : y
Success.


Normally, root should only be allowed to connect from
'localhost'. This ensures that someone cannot guess at
the root password from the network.

Disallow root login remotely? (Press y|Y for Yes, any other key for No) : y
Success.

By default, MySQL comes with a database named 'test' that
anyone can access. This is also intended only for testing,
and should be removed before moving into a production
environment.


Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y
 - Dropping test database...
Success.

 - Removing privileges on test database...
Success.

Reloading the privilege tables will ensure that all changes
made so far will take effect immediately.

Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y
Success.

All done!

创建数据库导入SQL文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
wget https://github.com/AutohomeCorp/frostmourne/blob/master/doc/mysql-schema/frostmourne.sql

## 可能需要挂国际代理，或浏览器下载，使用SCP上传即可.

mysql -uroot -p < frostmourne.sql

#输入密码即可导入创建数据库。

mysql -uroot -p
mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| frostmourne        |
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
5 rows in set (9527.01 sec)


#查看数据库是否正常创建, quit命令退出。

下载frostmourne

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
cd /opt
mkdir frostmourne
cd frostmourne

wget https://github.com/AutohomeCorp/frostmourne/releases/download/1.0-RELEASE/frostmourne-monitor-1.0-RELEASE.zip

## 可能需要挂国际代理，或浏览器下载，使用SCP上传到opt目录即可.
## Github 下载地址 https://github.com/AutohomeCorp/frostmourne/releases

dnf install unzip 

unzip frostmourne-monitor*.zip 

tree 
.
├── application.properties
├── env
├── frostmourne-monitor-1.0-RELEASE.jar
├── frostmourne-monitor-1.0-RELEASE.zip
└── scripts
    ├── shutdown.sh
    └── startup.sh

1 directory, 6 files
## 文件树如上。

修改ENV 环境文件，配置java路径

1
2
3
4
5
6
7
8
9
vim /opt/frostmourne/env 


JAVA_HOME=/opt/java1.8/jdk8u362-b09
##配置文件上面操作解压的JDK路径即可

JAVA_OPTS="-Xms1200m -Xmx2000m -Xss1024K -XX:PermSize=128m -XX:MaxPermSize=256m -Dfile.encoding=utf-8"
##JAVA参数，可适当改大内存等参数。

修改启动app配置(也可以配置邮件发送服务器和LDAP)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
vim /opt/frostmourne/application.properties 

alarmlog_reserve_days=30
#配置监控日志保留天数

datasource_frostmourne_url=jdbc:mysql://127.0.0.1:3306/frostmourne?characterEncoding=utf8
#配置mysql数据库IP地址、数据库名字、编码。

datasource_frostmourne_username=root
datasource_frostmourne_password=Wow@123
#配置mysql数据库账号密码


frostmourne_monitor_address=192.168.124.100

#配置为本机IP地址即可

frostmourne_message_title=Wow
#配置实例名字

启动测试

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
/opt/frostmourne/scripts/startup.sh 

./startup.sh: line 7: dos2unix: command not found
LOG_DIR: /opt/frostmourne/scripts/../logs
PID_FOLDER: /opt/frostmourne/scripts/../pid
Sun Mar 26 16:42:27 CST 2023 ==== Starting ==== 
Application is running as root (UID 0). This is considered insecure.
Started [5477]
Waiting for server startup..
Sun Mar 26 16:42:37 CST 2023 Server started in 10 seconds

ss -an | grep 10054
tcp   LISTEN 0      100                    *:10054           *:*                  

## 查看10054端口监听即可判断已正常启动。

/opt/frostmourne/scripts/shutdown.sh 

## 停止服务

Web访问： http://192.168.124.100:10054 即可测试，注意替换IP

admin 管理账号默认的账号密码是123456

注意：开启了LDAP认证，admin账号仍然可以用初始密码登录。

配置为Systemd自定义服务并设置开机启动

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
vim /usr/lib/systemd/system/frostmourne.service 


[Unit]
Description=frost
After=network.target mysqld.service

[Service]
User=root
Type=forking
ExecStart=/opt/frostmourne/scripts/startup.sh
ExecStop=/opt/frostmourne/scripts/shutdown.sh
RemainAfterExit=yes



[Install]
WantedBy=multi-user.target

##写入到文件保存。

systemctl daemon-reload
## 加载自定义服务
systemctl start frostmourne.service 
systemctl status frostmourne.service 

## 尝试启动，并查看状态。
systemctl enable frostmourne.service 

## 设置开启及并启动

注意：需要等待网络服务和Mysql启动之后，才会启动。

技术架构

frostmourne-vue：前端项目，使用vue-element-template实现，打包时会把生成的资源文件构建到frostmourne-monitor

  • frostmourne-monitor：监控运行主体服务

主要技术栈

  • springboot 2.x
  • element ui
  • vue-admin-template
  • xxl-job
  • mybatis
  • freemarker
  • elasticsearch
  • InfluxDB
  • jjwt
  • nashorn

参考

官方文档：https://github.com/AutohomeCorp/frostmourne

注意：推荐配合https://songxwn.com/elk/ ELK部署使用。

集群：安装教程：https://songxwn.com/elk_cluster/

使用参考： https://songxwn.com/frostmourne_use

技术交流群

发送邮件到 ➡️ me@songxwn.com

或者关注WX公众号：网工格物

linux > ELK
#Linux #elk #syslog #wecom
Frostmourne (霜之哀伤) ELK日志告警系统部署教程
https://songxwn.com/frostmourne_install/
作者
Song
发布于
2023年3月26日
更新于
2024年7月2日
许可协议