vlambda博客
学习文章列表

下载：Linux System Package:AuditBeat(Version:7.4.2):curl -L -O https://artifacts.elastic.co/downloads/beats/auditbeat/auditbeat-7.4.2-linux-x86_64.tar.gzElasticSearch(Version:7.4.2):curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.4.2-linux-x86_64.tar.gzKibana(Version:7.4.2):curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-7.4.2-linux-x86_64.tar.gz

解压：tar -xvf auditbeat-7.4.2-linux-x86_64.tar.gz tar -xvf elasticsearch-7.4.2-linux-x86_64.tar.gztar -xvf kibana-7.4.2-linux-x86_64.tar.gz

配置Java环境（ES）yum -y install java-1.8.0-openjdk java-1.8.0-openjdk-develjava -version

ElasticSearch:配置并启动ES（配置文件如下图）：ulimit -a #此时我们默认的Open Files 是1024，需要调整限制vim /etc/security/limits.conf添加如下内容:* soft nofile 65536* hard nofile 131072* soft nproc 2048* hard nproc 4096vim /etc/sysctl.conf添加以下内容vm.max_map_count=655360 #设置单个JVM下支撑线程数然后如下：sysctl -p #使其生效ES不允许用root启动，所以需要创建普通用户EAK然后启动ES~useradd EAK #创建用户chown EAK.EAK /usr/local/elasticsearch -R #修改用户属性#相对路径./bin/elasticsearch-setup-passwords interactive #开启安全认证 输入Y然后设置各个用户密码使用普通用户启动ES：su - EAK -c /usr/local/elasticsearch/bin/elasticsearch #启动验证：建议直接用web输入密码访问9200端口验证
ES Config:#################################### Http #####################################http.port: 9200network.host: 0.0.0.0 #定义访问地址http.max_content_length: 100mb#################################### Node #####################################node.name: node-1 #定义节点名字cluster.initial_master_nodes: ["node-1"]#################################### security #####################################xpack.security.enabled: true #开启密码认证xpack.security.transport.ssl.enabled: true#################################### Paths ####################################path.data: /usr/local/elasticsearch/datapath.logs: /usr/local/elasticsearch/logs############## Memory #################设置内存熔断参数，防止写入或查询压力过高导致OOM#indices.breaker.total.limit: 30%##indices.breaker.request.limit: 6%##indices.breaker.fielddata.limit: 3%##调小查询使用的cache，避免cache占用过多的jvm内存，具体数值可根据使用场景调整 #indices.queries.cache.count: 500##indices.queries.cache.size: 5%##适当增大写入buffer和bulk队列长度，提高写入性能和稳定性#indices.memory.index_buffer_size: 15%###读写文件方式#index.store.type: niofs

#设置kibana启动端口server.port: 9090#允许访问IP地址的网段server.host: "0.0.0.0"#将kibana设置为中文i18n.locale: "zh-CN"#设置es地址elasticsearch.hosts: ["http://127.0.0.1:9200"]#xpack认证配置xpack.security.encryptionKey: "something_at_least_32_characters"xpack.reporting.encryptionKey: "b_random_string"#配置es访问密码elasticsearch.username: "kibana"elasticsearch.password: ""#使用高德地图map.tilemap.url: 'http://webrd02.is.autonavi.com/appmaptile?lang=zh_cn&size=1&scale=1&style=7&x={x}&y={y}&z={z}'#Kibana刚启动时等待Elasticsearch的时间，单位mselasticsearch.startupTimeout: 5000#Elasticsearch等待分片响应的时间elasticsearch.requestTimeout: 30000

启动成功后，我们直接访问Kibana服务（如下）需要密码验证 端口：9090   用户为:elastic  

auditbeat.modules:- module: auditd # Load audit rules from separate files. Same format as audit.rules(7). audit_rule_files: [ '${path.config}/audit.rules.d/*.conf' ] audit_rules: | -a exit,always -F arch=b64 -F euid=0 -S execve -k root_acct -a exit,always -F arch=b32 -F euid=0 -S execve -k root_acct -a exit,always -F arch=b64 -F euid>=1000 -S execve -k user_acct -a exit,always -F arch=b32 -F euid>=1000 -S execve -k user_acct- module: file_integrity paths: - /bin - /usr/bin - /sbin - /usr/sbin - /etc- module: system datasets: - host # General host information, e.g. uptime, IPs - login # User logins, logouts, and system boots. - package # Installed, updated, and removed packages - process # Started and stopped processes - socket # Opened and closed sockets - user # User information exclude_files: - '(?i)\.sw[nop]$' - '~$' - '/\.git($|/)' state.period: 12h user.detect_password_changes: true login.wtmp_file_pattern: /var/log/wtmp* login.btmp_file_pattern: /var/log/btmp*setup.template.settings: index.number_of_shards: 1setup.template.name: "auditbeat" setup.template.pattern: "auditbeat-*" #setup.template.enabled: 'false' #这里表示是否启用模板setup.kibana: host: "127.0.0.1:9090"# setup.dashboards.enabled: trueoutput.elasticsearch:# # Array of hosts to connect to. hosts: ["127.0.0.1:9200"] username: "elastic" password: ""index: "other.auditbeat-%{[beat.version]}-%{+yyyy.MM.dd}"processors: - add_host_metadata: ~ - add_cloud_metadata: ~