# 一、环境配置
1.准备了三台机器
```js
192.168.201.112
192.168.201.113
192.168.201.114
```

```js
hostnamectl set-hostname  ELK01
hostnamectl set-hostname  ELK02
hostnamectl set-hostname  ELK03
```


```js
cat >> /etc/hosts <<EOF
192.168.201.112 ELK01
192.168.201.113  ELK02
192.168.201.114  ELK03
EOF
```
2.临时关闭防火墙

```js
systemctl stop firewalld
```
3.永久关闭防火墙

```js
systemctl disable firewalld
```


4.关闭内存交换分区

```js
swapoff -a
```

```js
vim /etc/fstab
# 注释 swap 行
```

5.关闭selinux

```js
setenforce 0	
```
6.同步服务器时间

```js
yum install ntpdate -t
ntpdate -u ntp.aliyun.com
timedatectl set-timezone Asia/Shanghai
```

7.配置免密

A服务器 配置免密登录 如果没有~/.ssh目录下没有东西或没目录，用以下命令重新生成一下
```js
# 强制创建.ssh目录并设置权限
mkdir -p ~/.ssh
chmod 700 ~/.ssh

# 生成RSA密钥对（无密码）
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

# 设置密钥权限
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

# 将公钥追加到authorized_keys
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
```
把 A服务器 的公钥给到 B服务器，把 A服务器 的公钥放到 B服务器 的~/.ssh/authorized_keys里面

```js
#A服务器执行
cat id_rsa.pub
```

```js
#B服务器执行，然后把A服务器执行的查看到的公钥复制到B服务器
vi ~/.ssh/authorized_keys
```

# 二、安装Elasticsearch 7.17.29(单机部署)
核心功能：分布式搜索和分析引擎，负责存储、索引和快速检索数据（如日志、指标等）。

特点：支持实时搜索、高扩展性，通过倒排索引实现高效查询。


下载地址：https://www.elastic.co/downloads/past-releases/elasticsearch-7-17-29

rpm部署
```js
rpm elasticsearch-7.17.29-x86_64.rpm
```
启动服务
```js
systemctl start elasticsearch.service
```
修改配置文件
```js
vi /etc/elasticsearch/elasticsearch.yml
```

```yml
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
cluster.name: my-elk
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
node.name: elk01
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
network.host: 0.0.0.0
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["192.168.201.112","192.168.201.113","192.168.201.114"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#
# ---------------------------------- Security ----------------------------------
#
#                                 *** WARNING ***
#
# Elasticsearch security features are not enabled by default.
# These features are free, but require configuration changes to enable them.
# This means that users don't have to provide credentials and can get full access
# to the cluster. Network connections are also not encrypted.
#
# To protect your data, we strongly encourage you to enable the Elasticsearch security features. 
# Refer to the following documentation for instructions.
#
# https://www.elastic.co/guide/en/elasticsearch/reference/7.16/configuring-stack-security.html
```

![image.png](/static/img/6f0d355ba19e2b4f97b9f194b5634ed5.image.webp)


# 三、集群部署
都修改yml文件
```js
vi /etc/elasticsearch/elasticsearch.yml
```


```js
#改成对应的elk，如192.168.201.112是elk01,192.168.201.112是elk02
node.name: elk01

discovery.seed_hosts: ["192.168.201.112","192.168.201.113","192.168.201.114"]
```

测试集群是否都连上了
```js
[root@elk01 elasticsearch]# curl 192.168.201.113:9200/_cat/nodes?v
ip              heap.percent ram.percent cpu load_1m load_5m load_15m node.role   master name
192.168.201.114           11          97   0    0.03    0.04     0.05 cdfhilmrstw -      elk03
192.168.201.112           25          96   0    0.00    0.01     0.05 cdfhilmrstw *      elk01
192.168.201.113           10          96   0    0.00    0.01     0.05 cdfhilmrstw -      elk02
```

# 四、Kibana安装
核心功能：数据可视化平台，提供图表、仪表盘等工具，用于展示和分析Elasticsearch中的数据。

特点：支持交互式查询和自定义视图，便于监控和故障排查。

https://www.elastic.co/downloads/past-releases/kibana-7-17-29


```js
rpm -ivh kibana-7.17.29-x86_64.rpm
```
修改配置文件
```js
vi /etc/kibana/kibana.yml
```

```js

server.host: "0.0.0.0"

server.name: "elk"


elasticsearch.hosts: ["http://192.168.201.112:9200","http://192.168.201.113:9200","http://192.168.201.114:9200"]


i18n.locale: "zh-CN"
```

```js
systemctl start  kibana
```

![image.png](/static/img/288fc4bee7b1b31fad752717ede1ff1a.image.webp)




# 五、Filebeat
轻量级：相比Logstash，Filebeat占用资源极少，适合部署在边缘节点（如服务器、容器）持续采集日志文件。

专一性：仅负责日志收集和转发（到Logstash或Elasticsearch），不处理数据，避免资源浪费。

场景互补：Filebeat + Logstash组合中，Filebeat负责采集，Logstash负责复杂处理，分工明确提升效率。

下载命令
```js
wget  https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.17.29-x86_64.rpm
```

```js
vi /etc/filebeat/filebeat.yml 
```
编写一个测试数据
```js
filebeat.inputs:
  - type: stdin

output.console:
  pretty: true
```
指定配置文件启动
```js
filebeat -e -c /etc/filebeat/filebeat.yml
```
![image.png](/static/img/5b3e8defcb4963da720da1bf0e9b1711.image.webp)


1.ELK环境配置和安装

Linux免密登录确实是指A服务器通过SSH协议登录B服务器时无需手动输入密码。其核心原理是通过非对称加密的密钥对实现身份验证：A服务器生成公钥和私钥后，将公钥部署到B服务器的授权文件中，后续登录时B服务器会用该公钥验证A服务器的私钥，从而跳过密码验证环节

# A服务器 配置免密登录 如果没有~/.ssh目录下没有东西或没目录，用以下命令重新生成一下

```js
# 强制创建.ssh目录并设置权限
mkdir -p ~/.ssh
chmod 700 ~/.ssh

# 生成RSA密钥对（无密码）
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

# 设置密钥权限
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

# 将公钥追加到authorized_keys
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
```
# 把 A服务器 的公钥给到 B服务器

```js
$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGYg72GXNQmFPwEEp986OqHF7vCcVxJw6mox5iKifJReaUKdcLEXqjUcu6mUi29j3hFMi4QT7Oc3+JmgEeAxWLWmC4zADm0NWqzKDJ6qdptU01cMkFlukpBU9u/GBAyCLQ6sgK75O62HTIq2MVe9TqXOficr90IOSxpObPFq1ZEnWp6i76Ag7hMO3e8Hm4wSD4e6edxbDIgzzRNo58GO1YikHEiYkd86sMzJTI/Xf2myw9ETgen7MlFGrOgdBPktmD4Wexg3Ug72uZJxOB96sn5TOXzIYs9YsGvJeOsZ/zTk9okrRCIybjBjDJvmfDmjUNFF77byIFHCu2UAWpYGHeui3BlVwSjRdaysHIPFUEmadUwi0Oa3JpgnhU600UfsEJn3fGVm2XrwtLR0bhrj/LTsvM0UmvsAs0RC4b8EzrExbPWPfQPwUJLxKZcEfyW1cK6a4y8+qb2WV7HXv7acBtywTwBHAuuYeo6HKweyYoz/c2/pTWjZ3PpGETBUYB6km3WWrjDEzfxYVlGFb5mB+GWh1m5Knak9wABv06k9XVt3NL6ZjzkwH0WBd5Lr0YvfFocLLurq8gGjaBiWQ0lOPjDqILLwaV6Xm9ZoXyUb2My9yIBwYm2w9VhA9LreI0H8G8JDOzF+hBYV8ikF/8meqFuJgJMGe+/RZSNDhU/3FKQw== jenkins@5ca614ac051b
```
# 把 A服务器 的公钥放到 B服务器 的~/.ssh/authorized_keys里面

```js
vi ~/.ssh/authorized_keys
```

![b82dcae1b8802f9c7354499e1702fdaa_7cefdafdd8eedaf7e9279a361a62bcf4.image.webp](/static/img/11a4bd43ecf5857745bf55fc8a382798.b82dcae1b8802f9c7354499e1702fdaa_7cefdafdd8eedaf7e9279a361a62bcf4.image.webp)

# 然后测试免密是否成功，在A服务器执行ssh命令

![ef3cec66aa33ccbc67267156a03761bb_2ba284f1250e5c5d368c86ed2841b4ee.image.webp](/static/img/e1930cb3aa1c08df48a22f6e606b7df6.ef3cec66aa33ccbc67267156a03761bb_2ba284f1250e5c5d368c86ed2841b4ee.image.webp)

linux免密登录

# 一、把这几个配置文件丢到主节点服务器


vi service-account.yaml

```yml
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: exporter
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
  name: kube-state-metrics
  namespace: kube-system-xuan
```
vi cluster-role.yaml

```yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: exporter
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
  name: kube-state-metrics
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  - nodes
  - pods
  - services
  - serviceaccounts
  - resourcequotas
  - replicationcontrollers
  - limitranges
  - persistentvolumeclaims
  - persistentvolumes
  - namespaces
  - endpoints
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - statefulsets
  - daemonsets
  - deployments
  - replicasets
  verbs:
  - list
  - watch
- apiGroups:
  - batch
  resources:
  - cronjobs
  - jobs
  verbs:
  - list
  - watch
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - list
  - watch
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - list
  - watch
- apiGroups:
  - certificates.k8s.io
  resources:
  - certificatesigningrequests
  verbs:
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - list
  - watch
- apiGroups:
  - storage.k8s.io
  resources:
  - storageclasses
  - volumeattachments
  verbs:
  - list
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  - validatingwebhookconfigurations
  verbs:
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  - ingressclasses
  - ingresses
  verbs:
  - list
  - watch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - list
  - watch
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - rolebindings
  - roles
  verbs:
  - list
  - watch

```
vi cluster-role-binding.yaml

```yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: exporter
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
  name: kube-state-metrics
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kube-state-metrics
subjects:
- kind: ServiceAccount
  name: kube-state-metrics
  namespace: kube-system-xuan
```
vi  deployment.yaml

```js
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: exporter
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
  name: kube-state-metrics
  namespace: kube-system-xuan
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: kube-state-metrics
  template:
    metadata:
      labels:
        app.kubernetes.io/component: exporter
        app.kubernetes.io/name: kube-state-metrics
        app.kubernetes.io/version: 2.17.0
    spec:
      automountServiceAccountToken: true
      containers:
      - image: bitnami/kube-state-metrics:latest
        livenessProbe:
          httpGet:
            path: /livez
            port: http-metrics
          initialDelaySeconds: 5
          timeoutSeconds: 5
        name: kube-state-metrics
        ports:
        - containerPort: 8080
          name: http-metrics
        - containerPort: 8081
          name: telemetry
        readinessProbe:
          httpGet:
            path: /readyz
            port: telemetry
          initialDelaySeconds: 5
          timeoutSeconds: 5
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: kube-state-metrics
```

vi service.yaml

```js
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: exporter
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
  name: kube-state-metrics
  namespace: kube-system-xuan
spec:
  type: NodePort
  ports:
  - name: http-metrics
    port: 8080
    targetPort: 8080
    nodePort: 31666
    protocol: TCP
  selector:
    app.kubernetes.io/name: kube-state-metrics
```


```js
kubectl apply -f service-account.yaml
kubectl apply -f cluster-role.yaml
kubectl apply -f cluster-role-binding.yaml
kubectl apply -f deployment.yaml
kubectl apply -f service.yaml
```

# 二、配置普罗米修斯
prometheus.yml 
```yml
# 全局配置
global:
  # 数据抓取间隔（默认1分钟）
  scrape_interval: 15s
  # 告警规则评估频率（建议与抓取间隔一致）
  evaluation_interval: 15s
  # 抓取超时时间（默认10秒）

# 告警配置
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          # 启用Alertmanager时需配置实际地址
          # - alertmanager:9093

# 规则文件配置
rule_files:
  # 告警规则文件路径（支持通配符）
  # - 'alert_rules/*.rules'
  # 记录规则文件路径
  # - 'recording_rules/*.rules'

# 监控目标配置
scrape_configs:
  - job_name: "prometheus-server"
    file_sd_configs:
      - files:
          - /server/prometheus/node_exporter.yml
        refresh_interval: 5s

#nginx服务
  - job_name: nginx
    static_configs:
     - targets: ['192.168.201.104:9113']
     
#K8S服务器
  - job_name: K8S
    static_configs:
     - targets: ['192.168.201.100:31666']

```
然后重启普罗米修斯

# Grafana模版配置
https://grafana.com/grafana/dashboards/17519-kube-state-metrics-v2/
```json
17519
13105
```

![image.png](/static/img/d0406c74fe652fb2bc51fe37785f5994.image.webp)

7.Prometheus监控K8S


```js
vi /etc/containerd/config.toml
```


```js
bled_plugins = ["restart"]
[plugins.linux]
shim_debug = true

[plugins.cri.registry.mirrors."docker.io"]
endpoint = [
    "https://docker.m.daocloud.io",
    "https://docker.1panel.live",
    "https://hub.rat.dev",
    "https://registry-1.docker.io"  # 官方源保底
]

[plugins.cri]
sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.2"
```

```js
systemctl restart containerd
```



containerd加速镜像配置

# 一、先在nginx.conf配置加上监控配置

```js
    # 新增监控模块配置
location /nginx_status {
    stub_status on;
    allow all;  # 允许所有IP访问
}
```

完整配置：
```yml
    server {
        listen       81;   #监听的端口
        server_name  localhost;   #监听的主机IP
        

    # 新增监控模块配置
location /nginx_status {
    stub_status on;
    allow all;  # 允许所有IP访问
}



        location / {
            root   /usr/local/nginx/html;
            index  weihu.html;
          #  proxy_pass  http://songxuan;  #直接起个命名
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

    }
```
然后重启nginx让配置生效。
如果遇到执行报错问题，是你这个监控项安装nginx编译时没加这个。

```js
nginx: [emerg] unknown directive "stub_status" in /usr/local/nginx/conf/songxuan.conf:12
```

解决这个问题：
执行命令检查Nginx编译参数，若无输出则表示未编译该模块：
```js
nginx -V 2>&1 | grep -o with-http_stub_status_module
```
重新进入解压的nginx的包内，重新带编译安装，然后在用检查命令检查，然后启动。
```js
./configure --prefix=/usr/local/nginx --with-http_stub_status_module
make
make install
```

# 二、安装nginx-exporter，因为需要go语言环境，只能选择docker安装

```js
version: '3.8'
services:
  nginx-exporter:
    image: nginx/nginx-prometheus-exporter:latest
    ports:
      - "9113:9113"
    command: 
      - -nginx.scrape-uri=http://192.168.201.104/nginx_status  # 替换为您的实际Nginx状态页地址
    restart: unless-stopped
```
#  三、配置普罗米修斯的配置文件

```yml
# 全局配置
global:
  # 数据抓取间隔（默认1分钟）
  scrape_interval: 15s
  # 告警规则评估频率（建议与抓取间隔一致）
  evaluation_interval: 15s
  # 抓取超时时间（默认10秒）

# 告警配置
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          # 启用Alertmanager时需配置实际地址
          # - alertmanager:9093

# 规则文件配置
rule_files:
  # 告警规则文件路径（支持通配符）
  # - 'alert_rules/*.rules'
  # 记录规则文件路径
  # - 'recording_rules/*.rules'

# 监控目标配置
scrape_configs:
  - job_name: "prometheus-server"
    file_sd_configs:
      - files:
          - /server/prometheus/node_exporter.yml
        refresh_interval: 5s
        
#nginx监控项
  - job_name: nginx
    static_configs:
     - targets: ['192.168.201.104:9113']

```
然后重启普罗米修斯。

然后查看普罗米修斯nginx的已经监控到了

![image.png](/static/img/f058521c73e35f834f01c5a8eed6eb44.image.webp)

# 四、最后去grafana导入仪表盘展示

![image.png](/static/img/c733bb4cc8e8e6671f878775f6590243.image.webp)

![image.png](/static/img/7a65255344f5817873a1fa75007390e2.image.webp)
