{"id":1022,"date":"2015-11-03T09:51:02","date_gmt":"2015-11-03T07:51:02","guid":{"rendered":"http:\/\/www.ayhanarda.com\/blog\/?p=1022"},"modified":"2015-11-03T09:53:20","modified_gmt":"2015-11-03T07:53:20","slug":"cpaneldeki-sitelerin-access-loglarini-logstash-forwarder-ile-elkstack-ta-logstash-server-a-gonderme","status":"publish","type":"post","link":"https:\/\/www.ayhanarda.com\/blog\/2015\/11\/cpaneldeki-sitelerin-access-loglarini-logstash-forwarder-ile-elkstack-ta-logstash-server-a-gonderme\/","title":{"rendered":"Cpaneldeki Sitelerin Access Loglar\u0131n\u0131 Logstash-Forwarder ile ElkStack ta Logstash Server a G\u00f6nderme"},"content":{"rendered":"<p>Daha \u00f6nceki yaz\u0131lar\u0131m\u0131zda bir elkstack server kurmu\u015ftuk ancak hen\u00fcz farkl\u0131 bir serverdan log g\u00f6ndermemi\u015ftik , \u015fimdi \u00f6rnek olarak elimizde bir cpanel sunucu oldu\u011funu ve i\u00e7inde y\u00fczlerce site oldu\u011funu varsayal\u0131m , cpaneldeki sitelerin eri\u015fim loglar\u0131 bilindi\u011fi \u00fczere \/usr\/local\/apache\/domlogs\/ alt\u0131nda yer almaktad\u0131r , her bir site i\u00e7in bu yolda birer klas\u00f6r ve i\u00e7inde sitelerin loglar\u0131 yer almaktad\u0131r.<\/p>\n<p>\u015eimdi elkstack server\u0131n ad\u0131 <em>elkstack.ayhanarda.com<\/em> olsun , ip adresi <em>192.168.1.1<\/em> oldu\u011funu varsayal\u0131m , cpanel sunucu ad\u0131 ise <em>cpanel.ayhanarda.com<\/em> , ip adresi de <em>192.168.1.2<\/em> olsun.<\/p>\n<p>E\u011fer bu isimler i\u00e7in bir dns serverda kayd\u0131m\u0131z yok ise cpanel sunucuda a\u015fa\u011f\u0131daki dosyaya elkstack server\u0131n ip ve hostname ini girelim ki aramak ile vakit kaybetmesin. \/etc\/hosts dosyas\u0131n\u0131 a\u00e7\u0131p a\u015fa\u011f\u0131daki kayd\u0131 girelim , tabi hostname ve ip adresi Sizin yap\u0131n\u0131za g\u00f6re olmal\u0131.<\/p>\n<p>root@cpanel.ayhanarda.com [~]# <strong>nano \/etc\/hosts<\/strong><br \/>\n<strong>192.168.1.1 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 elkstack.ayhanarda.com<\/strong><\/p>\n<p>\u015eimdi centos repo suna logstash forwarder i\u00e7in kay\u0131t ekleyelim.<\/p>\n<p><strong>rpm &#8211;import http:\/\/packages.elasticsearch.org\/GPG-KEY-elasticsearch<\/strong><\/p>\n<p><strong>cat &gt;&gt; \/etc\/yum.repos.d\/logstash-forwarder.repo &lt;&lt; REPO<\/strong><br \/>\n<strong>[logstash-forwarder]<\/strong><br \/>\n<strong>name=logstash-forwarder repository<\/strong><br \/>\n<strong>baseurl=http:\/\/packages.elasticsearch.org\/logstashforwarder\/centos<\/strong><br \/>\n<strong>gpgcheck=1<\/strong><br \/>\n<strong>gpgkey=http:\/\/packages.elasticsearch.org\/GPG-KEY-elasticsearch<\/strong><br \/>\n<strong>enabled=1<\/strong><br \/>\n<strong>REPO<\/strong><\/p>\n<p>Art\u0131k logstash-forwarder kurmaya haz\u0131r\u0131z.<\/p>\n<p><strong>yum -y install logstash-forwarder<\/strong><\/p>\n<p>Elkstack serverda olu\u015fturdu\u011fumuz sertifikay\u0131 a\u015fa\u011f\u0131daki dosyan\u0131n i\u00e7ine girip kaydedelim , bu dosya yok ise olu\u015ftural\u0131m.<\/p>\n<p><strong>nano \/etc\/pki\/tls\/certs\/logstash-forwarder.crt<\/strong><\/p>\n<p><em>&#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;<\/em><br \/>\n<em>MIIDDTCCAfWgAwIBAgIJANcKD2AfHuraMA0GCSqGSIb3DQEBCwUAMB0xGzAZBgNV<\/em><br \/>\n<em>BAMMEmVsa3N0YWNrLm5hdHJvLmNvbTAeFw0xNTEwMjcxMTI4NTFaFw0yNTEwMjQx<\/em><br \/>\n<em>&#8230;<\/em><br \/>\n<em>&#8230;<\/em><br \/>\n<em>&#8230;<\/em><br \/>\n<em>&#8212;&#8211;END CERTIFICATE&#8212;&#8211;<\/em><\/p>\n<p>\u015eimdi logstash-forwarder \u0131n conf dosyas\u0131n\u0131 olu\u015ftural\u0131m.<\/p>\n<p><strong>nano \/etc\/logstash-forwarder.conf<\/strong><\/p>\n<p><em>{<\/em><br \/>\n<em>\u00a0 &#8220;network&#8221;: {<\/em><br \/>\n<em>&#8220;servers&#8221;: [ &#8220;<strong>elkstack.ayhanarda.com:5001<\/strong>&#8221; ],<\/em><br \/>\n<em>&#8220;timeout&#8221;: 15,<\/em><br \/>\n<em>&#8220;ssl ca&#8221;: &#8220;<strong>\/etc\/pki\/tls\/certs\/logstash-forwarder.crt<\/strong>&#8220;<\/em><br \/>\n<em>\u00a0 },<\/em><\/p>\n<p><em>&#8220;files&#8221;: [<\/em><br \/>\n<em>{<\/em><br \/>\n<em>\u00a0\u00a0\u00a0\u00a0\u00a0 &#8220;paths&#8221;: [<\/em><br \/>\n<em>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8220;<strong>\/usr\/local\/apache\/domlogs\/*\/*<\/strong>&#8220;<\/em><br \/>\n<em>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ],<\/em><br \/>\n<em>\u00a0\u00a0\u00a0\u00a0\u00a0 &#8220;fields&#8221;: { &#8220;type&#8221;: &#8220;<strong>apache-access<\/strong>&#8221; }<\/em><br \/>\n<em>\u00a0\u00a0\u00a0 }<\/em><br \/>\n<em>]<\/em><br \/>\n<em>}<\/em><\/p>\n<p>Yukar\u0131daki dosyada dikkat ederseniz 4 farkl\u0131 ve \u00f6nemli b\u00f6l\u00fcm\u00fc i\u015faretledim , birincisi loglar\u0131 nereye ve hangi porta iletece\u011fimiz , ikincisi bir \u00f6nceki ad\u0131mda haz\u0131rlad\u0131\u011f\u0131m\u0131z ssl dosyas\u0131n\u0131n yolu , \u00fc\u00e7\u00fcnc\u00fcs\u00fc cpanel sunucudaki hangi loglar\u0131 g\u00f6nderece\u011fimiz , d\u00f6rd\u00fcnc\u00fcs\u00fc ise bu loglar\u0131n \u00e7e\u015fidi.<\/p>\n<p>\u015eimdi logstash forwarder \u0131 ba\u015flatal\u0131m ve ayn\u0131 zamanda sunucunun bir sonraki a\u00e7\u0131l\u0131\u015f\u0131nda otomatik olarak \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flayal\u0131m.<\/p>\n<p><strong>service logstash-forwarder restart &amp;&amp; chkconfig logstash-forwarder on<\/strong><\/p>\n<p>Conf dosyam\u0131zda <strong>5001<\/strong> nolu porta g\u00f6nderece\u011fimizi belirtmi\u015ftik , o halde cpanel server \u00fczerinde bir firewall kullan\u0131yor isek d\u0131\u015far\u0131ya do\u011fru bu portu aktif etmeliyiz , ben cpanel sunucularda csf kullanmaya \u00f6zen g\u00f6steriyorum , a\u015fa\u011f\u0131daki dosyasy\u0131 a\u00e7\u0131p tcp_out ve udp_out b\u00f6l\u00fcmlerine 5001 nolu portu ekliyorum. Buradaki 5001 portu elkstack server\u0131n\u0131z ile ilgili bir durum , yani orada kullanmay\u0131 se\u00e7ti\u011finiz porttur , Sizin elkstack ya da logstash server da bu farkl\u0131 olabilir.<\/p>\n<p>root@cpanel.ayhanarda.com [\/usr\/local\/apache\/logs]# cat \/etc\/csf\/csf.conf | grep TCP_OUT<br \/>\nTCP_OUT = &#8220;20,21,25,37,43,53,80,110,113,443,587,993,995,2086,2087,2089,2703,3306,4443,<strong>5001<\/strong>,6343,30000:35000,65000:65535&#8243;<br \/>\nroot@cpanel.ayhanarda.com [\/usr\/local\/apache\/logs]# cat \/etc\/csf\/csf.conf | grep UDP_OUT<br \/>\nUDP_OUT = &#8220;53,113,123,873,<strong>5001<\/strong>,6277,6343&#8243;<\/p>\n<p>sonras\u0131nda <strong>csf -r<\/strong> komutu ile csf yi restart edelim. E\u011fer csf kullanm\u0131yor iseniz iptables \u00fczerinden direkt olarak ta a\u00e7abilirsiniz.<\/p>\n<p>\u015eimdi e\u011fer elkstack bu portu dinliyor , cpanel de log g\u00f6nderiyor ise bunu a\u015fa\u011f\u0131daki dosyay\u0131 izleyerek g\u00f6rebilirsiniz<\/p>\n<p><strong>tail -f \/var\/log\/logstash-forwarder\/logstash-forwarder.err<\/strong><\/p>\n<p>2015\/11\/03 06:57:38.745365 Setting trusted CA from file: \/etc\/pki\/tls\/certs\/logstash-forwarder.crt<br \/>\n2015\/11\/03 06:57:38.745939 Connecting to [192.168.1.1]:5001 (elkstack.ayhanarda.com)<br \/>\n2015\/11\/03 06:57:38.838187 Connected to 192.168.1.1<\/p>\n<p>Hepsi bu kadar , iyi \u00e7al\u0131\u015fmalar..<\/p>\n<p>Ayhan ARDA<\/p>\n<div style=\"padding-bottom:20px; padding-top:10px;\" class=\"hupso-share-buttons\"><!-- Hupso Share Buttons - https:\/\/www.hupso.com\/share\/ --><a class=\"hupso_toolbar\" href=\"https:\/\/www.hupso.com\/share\/\"><img decoding=\"async\" src=\"https:\/\/static.hupso.com\/share\/buttons\/lang\/tr\/share-medium.png\" style=\"border:0px; padding-top: 5px; float:left;\" alt=\"Share Button\"\/><\/a><script type=\"text\/javascript\">var hupso_services_t=new Array(\"Twitter\",\"Facebook\",\"Google Plus\",\"Pinterest\",\"Linkedin\");var hupso_background_t=\"#EAF4FF\";var hupso_border_t=\"#66CCFF\";var hupso_toolbar_size_t=\"medium\";var hupso_image_folder_url = \"\";var hupso_twitter_via=\"ayhanarda\";var hupso_url_t=\"\";var hupso_title_t=\"Cpaneldeki%20Sitelerin%20Access%20Loglar%C4%B1n%C4%B1%20Logstash-Forwarder%20ile%20ElkStack%20ta%20Logstash%20Server%20a%20G%C3%B6nderme\";<\/script><script type=\"text\/javascript\" src=\"https:\/\/static.hupso.com\/share\/js\/share_toolbar.js\"><\/script><!-- Hupso Share Buttons --><\/div>","protected":false},"excerpt":{"rendered":"Daha \u00f6nceki yaz\u0131lar\u0131m\u0131zda bir elkstack server kurmu\u015ftuk ancak hen\u00fcz farkl\u0131 bir serverdan log g\u00f6ndermemi\u015ftik , \u015fimdi \u00f6rnek olarak elimizde bir cpanel sunucu oldu\u011funu ve i\u00e7inde y\u00fczlerce site oldu\u011funu varsayal\u0131m , cpaneldeki sitelerin eri\u015fim loglar\u0131 bilindi\u011fi \u00fczere \/usr\/local\/apache\/domlogs\/ alt\u0131nda yer almaktad\u0131r , her bir site i\u00e7in bu yolda birer klas\u00f6r ve i\u00e7inde sitelerin loglar\u0131 yer almaktad\u0131r. [&hellip;]","protected":false},"author":1,"featured_media":1024,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[713,282,17,746,109],"tags":[891,890,887,885,883,889,840,888,877,886,879,878,880,881,882,884],"class_list":["post-1022","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bigdata","category-centos","category-cpanel","category-monitoring","category-whm-2","tag-centos-logstash-install","tag-centos-logstash-forwarder-kurulumu","tag-comlogs-logstash","tag-cpanel-elkstack","tag-cpanel-logstash","tag-elastic-search","tag-elkstack","tag-kibana","tag-logstash","tag-logstash-ayhan-arda","tag-logstash-egitimi","tag-logstash-forwarder","tag-logstash-ile-log","tag-logstash-port","tag-logstash-server","tag-whm-logstash"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/posts\/1022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/comments?post=1022"}],"version-history":[{"count":4,"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/posts\/1022\/revisions"}],"predecessor-version":[{"id":1028,"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/posts\/1022\/revisions\/1028"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/media\/1024"}],"wp:attachment":[{"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/media?parent=1022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/categories?post=1022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ayhanarda.com\/blog\/wp-json\/wp\/v2\/tags?post=1022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}