在Fedora 35 Server上安装ElastiFlow 5.2.0

客官°小女子只卖身不卖艺 2023-10-01 08:48 30阅读 0赞

ElastiFlow 5.X去掉了之前版本对logstash的依赖，独立开发了替代组件ElastiFlow™ Unified Flow Collector，解决了logstash启动、关闭、运行缓慢的问题，但许可方面进行了限制，社区版限制Unified Flow Collector使用一个CPU内核。

#### **linux系统** ####

禁用 selinux 。  
\* 需要重新启动才能使其成为永久设置。

# vi /etc/sysconfig/selinux
    
    SELINUX=disabled

#### **关闭防火墙** ####

打开firewall-cmd需要的端口

systemctl stop firewalld.service #停止firewall
    systemctl disable firewalld.service #禁止firewall开机启动

#### **OpenJDK 安装** ####

安装 OpenJDK。

# yum install java-1.8.0-openjdk-devel

#### **导入 GPG 密钥** ####

参考[原始手册][Link 1]安装 GPG KEY。

# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

#### **创建存储库文件** ####

参考[原始手册][Link 1]创建 ElasticSearch、Kibana 和 Logstash 存储库文件。

vi /etc/yum.repos.d/elastic-7.x.repo
    
    [elastic-7.x]
    name=elastic repository for 7.x packages
    baseurl=https://artifacts.elastic.co/packages/7.x/yum
    gpgcheck=1
    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
    enabled=0
    autorefresh=1
    type=rpm-md

安装

yum install --enablerepo=elastic-7.x elasticsearch
    yum install --enablerepo=elastic-7.x kibana

#### **各种设置更改** ####

由于除非您更改集群设置，否则 ElasticSearch 不会启动，  
因此请按如下方式修改/etc/elasticsearch/elasticsearch.yml。

vi /etc/elasticsearch/elasticsearch.yml
    
    #discovery.seed_hosts: ["host1", "host2"]
    discovery.type: single-node

从 Kibana 设置更改备用 IP 地址。

vi /etc/kibana/kibana.yml
    #server.host: "localhost"
    server.host: "0.0.0.0"

#### **服务注册、自动启动和启动设置** ####

# systemctl daemon-reload
    # systemctl enable elasticsearch.service
    # systemctl start elasticsearch.service
    # systemctl status elasticsearch.service

# systemctl daemon-reload
    # systemctl enable kibana.service
    # systemctl start kibana.service
    # systemctl status kibana.service

systemctl status 执行服务名时确认正常启动。

#### **安装 ElastiFlow** ####

参考[Linux | ElastiFlow][Linux _ ElastiFlow]安装 ElastiFlow。

下载flow-collector-5.2.0-1.x86\_64.rpm

wget https://elastiflow-packages.s3.amazonaws.com/flow-collector/flow-collector-5.2.0-1.x86_64.rpm

安装libpcap-devel

dnf install -y libpcap-devel

安装flow-collector-5.2.0-1.x86\_64.rpm

dnf install -y flow-collector-5.2.0-1.x86_64.rpm

修改配置文件

/etc/systemd/system/flowcoll.service.d/flowcoll.conf

vi /etc/systemd/system/flowcoll.service.d/flowcoll.conf
    
    设置EF_FLOW_OUTPUT_ELASTICSEARCH_ENABLE=true
    
    # Elasticsearch
    Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_ENABLE=true"

#### 实际使用时根据情况还需要修改监听端口 ####

#### EF\_FLOW\_SERVER\_UDP\_PORT[\#][Link 2] ####

The UDP port(s) on which the collector will create a socket to receive incoming packets. Multiple ports may be specified, separated by a comma. For example `2055,6343,4739`

*  Valid Values
    
     *  Any valid port number. Common values include:
        
         *  `2055`: the standard port for Netflow
         *  `4739`: the standard port for IPFIX
         *  `6343`: the standard port for sFlow
         *  `9995-9998`: commonly use port numbers
 *  Default
    
     *  `9995`

Environment="EF_FLOW_SERVER_UDP_PORT=9995"

使用 [GitHub - nerdalert/nflow-generator: NetFlow Generator for Testing Flow Collection Apps][GitHub - nerdalert_nflow-generator_ NetFlow Generator for Testing Flow Collection Apps]在Linux下生成flow测试，或者使用flowalyzer.exe或NetflowGenerator.exe在 Windows下生成flow测试。

参考 [Kibana | ElastiFlowKibana enables you to interactively explore, visualize, and share insights into your network flow data, as well as manage and monitor Elasticsearch.![favicon.ico][]https://docs.elastiflow.com/docs/kibana][Kibana _ ElastiFlowKibana enables you to interactively explore_ visualize_ and share insights into your network flow data_ as well as manage and monitor Elasticsearch._favicon.ico_https_docs.elastiflow.com_docs_kibana]

在Kibana上导入 [https://raw.githubusercontent.com/elastiflow/elastiflow\_for\_elasticsearch/master/kibana/kibana-7.12.x-codex-light.ndjson![icon-default.png_t_LA92][]https://raw.githubusercontent.com/elastiflow/elastiflow\_for\_elasticsearch/master/kibana/kibana-7.12.x-codex-light.ndjson][https_raw.githubusercontent.com_elastiflow_elastiflow_for_elasticsearch_master_kibana_kibana-7.12.x-codex-light.ndjson_icon-default.png_t_LA92_https_raw.githubusercontent.com_elastiflow_elastiflow_for_elasticsearch_master_kibana_kibana-7.12.x-codex-light.ndjson]

![watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAYWxsd2F5Mg_size_20_color_FFFFFF_t_70_g_se_x_16][]

Elastic Stack 7免费版支持设置用户密码登录，进行如下设置：

vi /etc/elasticsearch/elasticsearch.yml

新增以下配置:

xpack.security.enabled: true
    
       xpack.license.self_generated.type: basic
    
       xpack.security.transport.ssl.enabled: true

修改完配置后重启elasticsearch服务

systemctl restart elasticsearch

初始化密码

执行：/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive

修改kibana.yml配置信息

vi /etc/kibana/kibana.yml

elasticsearch.username: "kibana"
    elasticsearch.password: "your_password"

然后重启kibana服务

systemctl restart kibana

编辑ElastiFlow设置

vi /etc/systemd/system/flowcoll.service.d/flowcoll.conf
    
    设置EF_FLOW_OUTPUT_ELASTICSEARCH_PASSWORD=your_password
    
    # A comma separated list of Elasticsearch nodes to use. DO NOT include "http://" or "https://"
    Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_ADDRESSES=127.0.0.1:9200"
    Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_USERNAME=elastic"
    Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_PASSWORD=your_password"

重启ElastiFlow

systemctl restart flowcoll.service

访问kibana登录页面，登录账号为elastic  
![watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAYWxsd2F5Mg_size_20_color_FFFFFF_t_70_g_se_x_16 1][]

[Link 1]: https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html
[Linux _ ElastiFlow]: https://docs.elastiflow.com/docs/install_linux
[Link 2]: https://docs.elastiflow.com/docs/config_ref_input_udp#ef_flow_server_udp_port
[GitHub - nerdalert_nflow-generator_ NetFlow Generator for Testing Flow Collection Apps]: https://github.com/nerdalert/nflow-generator
[favicon.ico]: https://docs.elastiflow.com/img/favicon.ico
[Kibana _ ElastiFlowKibana enables you to interactively explore_ visualize_ and share insights into your network flow data_ as well as manage and monitor Elasticsearch._favicon.ico_https_docs.elastiflow.com_docs_kibana]: https://docs.elastiflow.com/docs/kibana
[icon-default.png_t_LA92]: https://csdnimg.cn/release/blog_editor_html/release1.9.5/ckeditor/plugins/CsdnLink/icons/icon-default.png?t=LA92
[https_raw.githubusercontent.com_elastiflow_elastiflow_for_elasticsearch_master_kibana_kibana-7.12.x-codex-light.ndjson_icon-default.png_t_LA92_https_raw.githubusercontent.com_elastiflow_elastiflow_for_elasticsearch_master_kibana_kibana-7.12.x-codex-light.ndjson]: https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/kibana-7.12.x-codex-light.ndjson
[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAYWxsd2F5Mg_size_20_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/9f3880b55a9c4372972d11ef088b0d48.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBAYWxsd2F5Mg==,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAYWxsd2F5Mg_size_20_color_FFFFFF_t_70_g_se_x_16 1]: https://img-blog.csdnimg.cn/1acff9c61f19450ab61e87e0798bf2a3.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBAYWxsd2F5Mg==,size_20,color_FFFFFF,t_70,g_se,x_16