Elasticsearch + Nginx Access Log using Kibana and FileBeat

Long time no see. Very short post today, very fast howto to implement access log logging to elasticsearch using simple utilities.

First of all, I expect you have already setup your elastic cluster with Kibana or Grafana or whatever.

Rsyslog + Elasticsearch/Redis backend template

Here is example of template when using redis or Elasticsearch backend for rsyslog. Very usefull along with logstash and kibana.

 

module(load="omhiredis")
template(name="ls_json" type="list" option.json="on")
   { constant(value="{")
     constant(value="\"timestamp\":\"")         property(name="timegenerated" dateFormat="rfc3339")
     constant(value="\",\"message\":\"")         property(name="msg")
     constant(value="\",\"host\":\"")            property(name="fromhost")
     constant(value="\",\"host_ip\":\"")         property(name="fromhost-ip")
     constant(value="\",\"logsource\":\"")       property(name="fromhost")
     constant(value="\",\"severity_label\":\"")  property(name="syslogseverity-text")
     constant(value="\",\"severity\":\"")        property(name="syslogseverity")
     constant(value="\",\"facility_label\":\"")  property(name="syslogfacility-text")
     constant(value="\",\"facility\":\"")        property(name="syslogfacility")
     constant(value="\",\"program\":\"")         property(name="programname")
     constant(value="\",\"pid\":\"")             property(name="procid")
     constant(value="\",\"syslogtag\":\"")       property(name="syslogtag")
     constant(value="\"}\n")
   } 
*.* action(
  name="push_redis"
  type="omhiredis"
  server="127.0.0.1"
  mode="queue"
  key="syslog"
  template="ls_json"
)

 

RIPE-Atlas Anchor installation

Ripe-Atlas project Anchor installation.

Anchor is high capacity RIPE-Atlas probe for internet measurements.

Anchor mainly consist of  Soekris Net6501-70 board (can find on kd85.com) and running Centos 6.x.

 

 

[gallery link="file" ids="802,801,800,799"]

Analyzing Spam - Visualization

Beautiful image of visualization spam traffic on primary mailserver.

Every blue path is spam detected and delivered to mailbox spam folder, every yellow path is rejected spam.

How to handle thousands of reports from servers - Logstash, ElasticSearch, Kibana

Many services and server audit utilities like logcheck, logwatch, cron daemon, aide, ZRM, etc. are sending emails to local user or root. Some of them, can be easily configured but some of them not.

Best way in my case is to deal with emails directly, but how ?

Gitolite recover from lost authorized_keys

Sometimes bad things happed and you have to recover your git server from backup or you have corrupted authorized_keys for git user.

First of all, you should know what paths and user you using. For this example we have:

User: git

Home: /home/git

Repositories: /data/git (linked into /home/git as repositories)

Samsung SSD 840 PRO - performance degradation

About year ago I wrote blogpost about endurance and performance test of Samsung SSD 840 PRO. Some things has changed, especially firmware of disks.

I performed test on disk with firmware DXM04B0Q. When you want to buy this disk now you probably have firmware DXM05B0Q or DXM06B0Q.

Problem is, both new firmwares has the same performance degradation issue.

Since my first blogpost we bought about 100 disks and after few months we're started observing some problems on database servers. Servers and disks was very slow, we are talking about 10 MB/s continuous write speed.

First of all, we repeat our direct disk test, then we started to test disk with different filesystems.

Command Line Tool for iRedMail (MySQL backend only)

Hi,

if anyone is interested in  open source mail server solution iRedMail and use MySQL as backend should now use my small cli script. Script has limited functions but it's perfect for things like importing new domains or creating many email accounts.

Script is opensource and use some functions from original iredadmin web management. So you need iredadmin installed, which is default option.

iRedMail CLI Tool on Github

Forgotten Skills: Build your own linux kernel

Firt we will talk about WHY. Many people have many opinions on that and I'd like to present you mine.

I work as System Specialist. During my work I often came to point that normal kernel from distribution doesn't work. Whole or part of server was unusable because one of these common reasons:

• Virtualization support with combination of new HW


• Missing driver for some Raid Controllers


• Missing driver for network cards


• Security hardening patches for specific systems

I don't remember which of the reason was the first when I must build my own kernel to be able use server or computer with all it's hardware. In few next years another big reason appear.

• New kernel have fixed some performance issues

Now we can talk about how to do it.

HowTo use Grub rescue mode

Sometimes when you upgrade or migrate your linux from one disk to another, boot should hang out on line  "grub rescue>",

what now ?

Configure different DNS resolvers for domains in Ubuntu

This is simple How-To which describe how to configure Ubuntu to use different DNS servers for various domains. It's very useful feature when you want to connect to your office VPN and use office DNS servers for intranet domain but for other domains you want to use your own or your ISP DNS servers.

Situation:

• domain.intra - resolve hosts from dns server 192.168.30.1


• home.intra - resolve hosts from this domain from 192.168.0.1


• other domains resolve from your default DNS server (ISP, or home etc.)

BASH GIT prompt

I'd like to introduce you my bash shell which can handle GIT information.

More information and sources are hosted on Github.

 Basic prompt

Automatic server audit for RackTables project

First I'd like to introduce one very nice project called RackTables. It's management system for DataCenters or rack rooms. I test many project like this but this one fits best for our needs. With this system you can document your network and infrastructure. Datacenters, rooms, rack rows, servers and their attributes, ipv4/ipv6 ranges, virtual resources, etc.

I work as System Specialist, many times it's too much work and I forgot to document some changes which I made on server or infrastructure. When number of servers grows to hundreds this is a really big problem you must handle. Important is also to know, what was the change, not only actual state. So you must create log of changes.

I have created one small script which discover physical or virtual server and insert or update information into racktables database and ! it create LOG in RackTables. You see what was the previous state and when this change was made.

Script can handle various system and HW infromation and what is perfect, it do it automatically without any interaction.

How To Boost mailserver storage performance using Facebook FlashCache

Few months ago we had performance problem with mailserver storage.

Storage has 3 HDD in RAID5 configuration. Average disk utilization per
one disk was about 90 % - 97%.
One of goals was incrase storage performance but with minimum downtime
so -> no data migration.