[B! ãƒã‚°][server] beth321ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

beth321 id:beth321

ãƒã‚°ã¨serverã«é–¢ã™ã‚‹beth321ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

OSSEC ã§ã¯ã˜ã‚ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚°ç›£è¦– - ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰é–‹ç™ºè€…ãƒ–ãƒã‚°
ã‚¤ãƒ³ãƒ•ãƒ©ã‚¹ãƒˆãƒ©ã‚¯ãƒãƒ£ãƒ¼éƒ¨ã®æ˜Ÿ (@kani_b) ã§ã™ã€‚ Heartbleed, ShellShock, XSA-108 (a.k.a. EC2 ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹å†èµ·å‹•ç¥), POODLE ãªã©ã€ä»Šå¹´ã¯è©±é¡Œã¨ãªã‚‹ã‚ˆã†ãªè„†å¼±æ€§ãŒå„åœ°ã‚’è¥²ã†ä¸€å¹´ã§ã—ãŸã€‚ è„†å¼±æ€§ã¸ã®å¯¾å¿œã«åŠ ãˆã€ã„ã‚ã‚†ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«æ—¥é ƒé ã‚’æ‚©ã¾ã›ã¦ã„ã‚‹æ–¹ã‚‚å¤šã„ã®ã§ã¯ãªã„ã‹ã¨æ€ã„ã¾ã™ã€‚ ä¸€è¨€ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã¨è¨€ã£ã¦ã‚‚ã€å®Ÿéš›ã‚„ã‚‹ã¹ãã“ã¨ã¯å¤šå²ã«ã‚ãŸã‚Šã¾ã™ã€‚ä»Šå›žã¯ãã®ã†ã¡ã®ä¸€ã¤ã¨ã—ã¦ã€OSSEC ã¨ã„ã† IDS (ä¾µå…¥æ¤œçŸ¥ã‚·ã‚¹ãƒ†ãƒ ) ã‚’ä½¿ã£ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚°ç›£è¦–ã«ã¤ã„ã¦ã”ç´¹ä»‹ã—ã¾ã™ã€‚ OSSEC ã¨ã¯ OSSEC ã¯ã€ã„ã‚ã‚†ã‚‹ãƒ›ã‚¹ãƒˆåž‹ã® IDS (HIDS) ã§ã™ã€‚ä»¥ä¸‹ã®ã‚ˆã†ãªæ©Ÿèƒ½ã‚’æŒã£ã¦ã„ã¾ã™ã€‚ ãƒã‚°è§£æžã€ç›£è¦– ãƒ•ã‚¡ã‚¤ãƒ«ã®å¤‰æ›´ç›£è¦– rootkit ã®æ¤œçŸ¥ ãã‚Œã‚‰ã‚’ãƒˆãƒªã‚¬ã«ã—ãŸãƒ—ãƒã‚°ãƒ©ãƒ ã®è‡ªå‹•å®Ÿè¡Œ (Active Response)
beth321 2015/01/01
ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰

monitoring

security

ã‚µãƒ¼ãƒ

ãƒã‚°

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚ã¨ã§èªã‚€

ã‚¤ãƒ³ãƒ•ãƒ©

ç›£è¦–

server
ãƒªãƒ³ã‚¯
Webã‚µãƒ¼ãƒã®ãƒã‚°ã‚’ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã§è§£æžã€ç›£è¦–ã§ãã‚‹ã€ŽGoAccessã€ã‚³ãƒžãƒ³ãƒ‰ | ä¿ºçš„å‚™å¿˜éŒ² ã€œãªã‚“ã‹ã„ã‚ã„ã‚ã€œ
ä»Šå›žã¯ã€Webã‚µãƒ¼ãƒã®ãƒã‚°è§£æžã‚’ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã§è¡Œãˆã‚‹ã‚³ãƒžãƒ³ãƒ‰ã€ŽGoAccessã€ã‚’ç´¹ä»‹ã™ã‚‹ã€‚ 1.ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« ã¾ãšã¯ã‚³ãƒžãƒ³ãƒ‰ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã‹ã‚‰ã€‚ ä»¥ä¸‹ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã€‚ ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ã‹ã‚‰makeã™ã‚‹å ´åˆ wget http://tar.goaccess.io/goaccess-0.8.5.tar.gz tar -xzvf goaccess-0.8.5.tar.gz cd goaccess-0.8.5/ ./configure --enable-geoip --enable-utf8 make sudo make install ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ç®¡ç†ã‚½ãƒ•ãƒˆã‹ã‚‰ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹å ´åˆ brew install goaccess (Mac OS Xã®å ´åˆ) sudoÂ apt-get install goaccess (Debian/Ubuntuã®å ´åˆ) sudoÂ yum install goacc
beth321 2014/09/14
ãƒã‚°

ã‚³ãƒžãƒ³ãƒ‰

Linux

Server

web

ãƒ„ãƒ¼ãƒ«

log

access

apt

ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ
ãƒªãƒ³ã‚¯
Quickstart Guide | Fluentd
Letâ€™s get started with Fluentd! Fluentd is a fully free and fully open-source log collector that instantly enables you to have a â€˜Log Everythingâ€™ architecture with 125+ types of systems. Fluentd treats logs as JSON, a popular machine-readable format. It is written primarily in C with a thin-Ruby wrapper that gives users flexibility. Fluentdâ€™s scalability has been proven in the field: its largest u
beth321 2014/08/01
fluentd

log

tool

ãƒã‚°

fluent

server

document

package

install

ruby
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒã®è² è·ã‚„ä½¿ç”¨çŽ‡ãªã©ã‚’è¦‹ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã®ä¸€è¦§ - [Linux [Red Hat/CentOSãªã©]/ã‚µãƒ¼ãƒãƒ¼] ãºã‚“ãŸã‚“ info
ã‚µãƒ¼ãƒã®è² è·ãªã©ã®ç›£è¦–ã«ä½¿ã†ã‚³ãƒžãƒ³ãƒ‰ã„ã‚ã„ã‚ [å‚è€ƒè¨˜äº‹] ãƒã‚°ã‚’ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã«è¡¨ç¤ºã•ã›ã¦ç›£è¦–ã™ã‚‹æ–¹æ³• [å‚è€ƒè¨˜äº‹] PHPã§ãƒãƒ¼ãƒ‰ã‚¢ãƒ™ãƒ¬ãƒ¼ã‚¸ã‚’è¡¨ç¤ºã•ã›ã‚‹æ–¹æ³• [å‚è€ƒè¨˜äº‹] Cacti RRDToolã‚’åˆ©ç”¨ã—ãŸã‚µãƒ¼ãƒç›£è¦–ãƒ„ãƒ¼ãƒ« ãƒãƒ¼ãƒ‰ã‚¢ãƒ™ãƒ¬ãƒ¼ã‚¸(CPUè² è·çŠ¶æ…‹) w ã¾ãŸã¯ uptime ãƒ‡ã‚£ã‚¹ã‚¯ä½¿ç”¨çŽ‡ df ãƒ¡ãƒ¢ãƒªä½¿ç”¨çŠ¶æ³ free èµ·å‹•ä¸ã®ã‚¿ã‚¹ã‚¯ ps aux ãƒãƒ¼ãƒ‰ã‚¢ãƒ™ãƒ¬ãƒ¼ã‚¸ã€ãƒ¡ãƒ¢ãƒªä½¿ç”¨çŠ¶æ³ã€ã‚¿ã‚¹ã‚¯(è² è·é †) top ãƒ‡ã‚£ã‚¹ã‚¯I/O iostat ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã§è¦‹ã‚‹ã«ã¯ watch iostat iostatã‚’åˆ©ç”¨ã™ã‚‹ã«ã¯sysstatã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ãŒå¿…è¦ã§ã™ã€‚ yum install sysstat ãã®ä»–ã„ã‚ã„ã‚ sar -u 3 10 sarã¨ã¯System Admin Reporterã®ç•¥ã§ã™ã€‚ CPUã‚„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã€ãƒ¡ãƒ¢ãƒªã€ãƒ‡ã‚£ã‚¹ã‚¯ãªã©ã®æƒ…å ±ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ ãƒã‚°ã¯æ—¥
beth321 2014/07/28
linux

ã‚µãƒ¼ãƒ

ã‚³ãƒžãƒ³ãƒ‰

ç›£è¦–

server

IT

è³‡æ–™

ãƒã‚°

CPU

class
ãƒªãƒ³ã‚¯
Fluentd | Open Source Data Collector
Fluentd is an open source data collector for unified logging layer. Fluentd allows you to unify data collection and consumption for a better use and understanding of data.
beth321 2014/03/24
fluent

ruby

fluentd

json

log

server

logging

development

mongodb

software
ãƒªãƒ³ã‚¯
LTSVãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆãªãƒã‚°ã‚’ fluentd + GrowthForecast ã§æ–™ç† - naoyaã®ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼
ã“ã“æ•°å¹´ã®ãƒ‡ãƒ¼ã‚¿è§£æžã®é‡è¦æ€§ã®é«˜ã¾ã‚Šã‹ã‚‰ã€ãƒã‚°ã«é–¢ã™ã‚‹ã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ãŒæ–¹ã€…ã§æ´»ç™ºã«æŽ¢æ±‚ã•ã‚Œã¦ã„ã‚‹æ˜¨ä»Šã§ã”ã–ã„ã¾ã™ã€‚ã‚¦ã‚§ãƒ–ã‚µãƒ¼ãƒãƒ¼ã®å˜ç´”ãªã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã‚’ãã®ã¾ã¾ä¿å˜ã™ã‚‹ã§ã¯ãªãè¿½åŠ æƒ…å ±ã‚’æ·»åŠ ã—ã¦ã¿ãŸã‚Šã€ã‚ã‚‹ã„ã¯ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‹ã‚‰ç›´æŽ¥ãƒã‚°ã‚’åã„ã¦ãã‚Œã‚‰ã‚’ãƒ‡ãƒ¼ã‚¿ã‚¦ã‚§ã‚¢ã«æŠ•ã’è¾¼ã‚“ã§ï½¥ï½¥ï½¥ã¨ã„ã†ã®ã‚‚å½“ç„¶ã®ã‚ˆã†ã«è¡Œã†ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸãã€‚ ã—ã‹ã—ã‚ã¾ã‚Šè‡ªç”±åº¦ã®ãªã„ access_log ã® combined ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã€‚ã•ã¦ã©ã†ã—ãŸã‚‚ã‚“ã‹ï½¥ï½¥ï½¥ ã“ã“ã§ id:stanaka ã®ç™»å ´ã§ã™ã€‚ Labeled Tab Separated Valueã¨ã„ã†ã®ã¯ã€ã¯ã¦ãªã§ä½¿ã£ã¦ã„ã‚‹ãƒã‚°ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã®ã“ã¨ã§ã€åºƒãä½¿ã‚ã‚Œã¦ã„ã‚‹TSV(Tab Separated Value)ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã«ãƒ©ãƒ™ãƒ«ã‚’ä»˜ã‘ã¦æ‰±ã„æ˜“ãã—ãŸã‚‚ã®ã§ã™ã€‚ã¯ã¦ãªã§ã¯ã€ã‚‚ã†3å¹´ä»¥ä¸Šã€ã“ã®ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã§ãƒã‚°ã‚’æ®‹ã—ã¦ã„ã¦ã€one-linerã‹ã‚‰flue
beth321 2013/02/06
fluentd

Apache

log

ãƒã‚°

LTSV

growthforecast

é‹ç”¨

ã‚ã¨ã§ã¿ã‚‹

server

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Labeled Tab Separated Values (LTSV) ãƒŽã‚¹ã‚¹ãƒ¡ - stanaka's blog
è¿½è¨˜(2/8 11:30) id:naoyaã«ã‚ˆã‚‹ä¸€é€£ã®ã¾ã¨ã‚ãŒã€ä»ŠåŒ—ç”£æ¥ã€‘3åˆ†ã§åˆ†ã‹ã‚‹LTSVæ¥ç•Œã®ã¾ã¨ã‚ã€LTSVã€‘ - naoyaã®ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã«ã‚ã‚Šã¾ã™ã€‚ ã¾ãŸã€ä»•æ§˜ãªã©ã‚’ã¾ã¨ã‚ã‚‹ãŸã‚ã« http://ltsv.org/ ã‚’ç«‹ã¡ä¸Šã’ã¾ã—ãŸã€‚ è¿½è¨˜ã“ã“ã¾ã§ Labeled Tab Separated Values (LTSV) ã¨ã„ã†ã®ã¯ã€ã¯ã¦ãªã§ä½¿ã£ã¦ã„ã‚‹ãƒã‚°ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã®ã“ã¨ã§ã€åºƒãä½¿ã‚ã‚Œã¦ã„ã‚‹TSV(Tab Separated Value)ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã«ãƒ©ãƒ™ãƒ«ã‚’ä»˜ã‘ã¦æ‰±ã„æ˜“ãã—ãŸã‚‚ã®ã§ã™ã€‚ã¯ã¦ãªã§ã¯ã€ã‚‚ã†3å¹´ä»¥ä¸Šã€ã“ã®ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã§ãƒã‚°ã‚’æ®‹ã—ã¦ã„ã¦ã€one-linerã‹ã‚‰fluentdã€Apache Hiveã¾ã§å¹…åºƒãä¾¿åˆ©ã«ä½¿ãˆã¦ã„ã¾ã™ã€‚ ãƒã‚°ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã«æœŸå¾…ã•ã‚Œã‚‹ã“ã¨ã¯ã€ ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆãŒçµ±ä¸€ã•ã‚Œã¦ã„ã‚‹ â†’ å…±é€šã®ãƒ„ãƒ¼ãƒ«ã§é›†è¨ˆã—æ˜“ã„ æ–°ã—ã„ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ã®è¿½åŠ ãŒå®¹æ˜“ â†’ ã‚µãƒ¼
beth321 2013/02/06
log

fluentd

é‹ç”¨

apache

hatena

server

programming

ã‚µãƒ¼ãƒ“ã‚¹

ãƒã‚°

format
ãƒªãƒ³ã‚¯
ã‚¤ãƒ™ãƒ³ãƒˆãƒã‚°åŽé›†ãƒ„ãƒ¼ãƒ« fluent ãƒªãƒªãƒ¼ã‚¹ï¼ - Blog by Sadayuki Furuhashi
ã“ã‚“ã«ã¡ã¯ã€‚Treasure Data ã®å¤æ©‹ã§ã™^^; å…ˆæ—¥ã® Treasure Data, Inc. å£®è¡Œä¼š ã§ã€ã‚¤ãƒ™ãƒ³ãƒˆãƒã‚°åŽé›†ãƒ„ãƒ¼ãƒ« fluent ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸï¼ Fluent event collector fluent ã¯ syslogd ã®ã‚ˆã†ãªãƒ„ãƒ¼ãƒ«ã§ã€ã‚¤ãƒ™ãƒ³ãƒˆãƒã‚°ã®è»¢é€ã‚„é›†ç´„ã‚’ã™ã‚‹ãŸã‚ã®ã‚³ãƒ³ãƒ‘ã‚¯ãƒˆãªãƒ„ãƒ¼ãƒ«ã§ã™ã€‚ ãŸã syslogd ã¨ã¯ç•°ãªã‚Šã€ãƒã‚°ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã« ãƒ†ã‚ã‚¹ãƒˆã§ã¯ãªã JSON ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆ ã‚’ä½¿ã„ã¾ã™ã€‚ã¾ãŸ ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚¢ãƒ¼ã‚ãƒ†ã‚¯ãƒãƒ£ ã‚’æŽ¡ç”¨ã—ã¦ãŠã‚Šã€ãƒã‚°ã®å…¥åŠ›å…ƒã‚„å‡ºåŠ›å…ˆã‚’ç°¡å˜ã«è¿½åŠ ã§ãã¾ã™ã€‚ Twitterã§ã‚‚è©±é¡Œæ²¸é¨°ä¸ã§ã™ï¼šã‚¤ãƒ™ãƒ³ãƒˆãƒã‚°åŽé›†ãƒ„ãƒ¼ãƒ« #fluent å‘¨ã‚Šã®æœ€è¿‘ã®è©±é¡Œ èƒŒæ™¯ ã€Œãƒã‚°ã®è§£æžã€ã¯ã€Webã‚µãƒ¼ãƒ“ã‚¹ã®å“è³ªå‘ä¸Šã®ãŸã‚ã«éžå¸¸ã«é‡è¦ã§ã™ã€‚Apacheã®ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã ã‘ã«é™ã‚‰ãšã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‹ã‚‰ãƒ¦ãƒ¼ã‚¶ã®æ€§åˆ¥ã‚„å¹´é½¢ãªã©ã®è©³ã—ã„æƒ…å ±ã‚’é›†ã‚
beth321 2012/04/02
Apache

Amazon

fluent

log

ãƒã‚°

ruby

Server

ãƒ„ãƒ¼ãƒ«

tool

json
ãƒªãƒ³ã‚¯
GNU awk (gawk) ã‚’ç”¨ã„ãŸ Apache ãƒã‚°è§£æžæ–¹æ³•
2. è‡ªå·±ç´¹ä»‹ æ–‰è—¤åšæ–‡ æ—¥æœ¬ GNU AWK ãƒ¦ãƒ¼ã‚¶ãƒ¼ä¼šä¸»å®°ã€‚ hi_sai [email protected] @hi_saito http://gauc.no-ip.org/awk-users-jp/ ã•ã¦ã€ä»Šå›žã®èª²é¡Œã§ã™ã€‚ 3. ç›®çš„ Apache ã®ãƒã‚°ã‚’ç°¡å˜ã«æ•´ç†ã—ãŸã„ã€‚ combined å½¢å¼ã§ã‚‚ common å½¢å¼ã§ã‚‚æ‰‹ è»½ã«å‡¦ç†ã—ãŸã„ã€‚ é …ç›®åˆ†å‰²ã‚’ç°¡å˜ã«ã—ãŸã„ã€‚ ã‚³ãƒ¼ãƒ‰ã®é‡ã‚’å°‘ãªãã€åˆ†ã‹ã‚Šã‚„ã™ãã—ãŸã„ã€‚ ã§ã‚‚ awk ã¯ Apache ã®å‡¦ç†ãŒè‹¦æ‰‹ã§ã™ã€‚ 4. ä½•æ•…ã€è‹¦æ‰‹ãªã®ã‹ ä½•æ•…ã€è‹¦æ‰‹ãªã®ã‹? Apache ã®ãƒã‚°é …ç›®ã¯ 3 ã¤ã®å½¢å¼ãŒã‚ã‚‹ã€‚ ã‚¹ãƒšãƒ¼ã‚¹åŒºåˆ‡ã€‚ â†’ awk ã§å‡¦ç†ã§ãã‚‹ã€‚ ãƒ€ãƒ–ãƒ«ã‚¯ã‚©ãƒ¼ãƒˆã§å›²ã¾ã‚Œã¦ä¸èº«ã«ã‚¹ãƒšãƒ¼ã‚¹ãŒå«ã¾ ã‚Œã‚‹ã€‚ å¤§æ‹¬å¼§ã§å›²ã¾ã‚Œã¦ä¸èº«ã«ã‚¹ãƒšãƒ¼ã‚¹ãŒå«ã¾ã‚Œã‚‹ã€‚ ãã‚“ãªæ™‚ã«ã¯ GNU awk (gawk) ã§ã™! 5. å½¢å¼ã® combined å½¢å¼ã®ãƒ
beth321 2012/04/02
apache

awk

ãƒã‚°

tips

server

httpd

ã¾ã¨ã‚

log

development
ãƒªãƒ³ã‚¯
1