스플렁크 RPM 설치는 간단하다.
[root@Centos7 ~] rpm -i splunk-8.2.2-87344edfcdb4-linux-2.6-x86_64.rpmwarning: splunk-8.2.2-87344edfcdb4-linux-2.6-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID b3cd4420: NOKEYuseradd: cannot create directory /opt/splunkcomplate[root@Centos7 ~][root@Centos7 ~] whereis splunksplunk: /opt/splunk/bin/splunk설치 후 스플렁크 명령어를 이용한 실행.
[root@Centos7 opt] splunk/bin/splunk start
Splunk> 4TW
Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history main securelog summary Done Checking filesystem compatibility... Done Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-8.2.2-87344edfcdb4-linux-2.6-x86_64-manifest' All installed files intact. DoneAll preliminary checks passed.
Starting splunk server daemon (splunkd)...Done [ OK ]
Waiting for web server at http://127.0.0.1:8000 to be available........ Done
If you get stuck, we're here to help.Look for answers here: http://docs.splunk.com
The Splunk web interface is at http://Centos7:8000서비스 상태를 확인해보자.
[root@Centos7 ~] service splunk statusRedirecting to /bin/systemctl status splunk.serviceFailed to get properties: Access denied엘라스틱은 RPM 설치 시 서비스 등록까지 완료되는데, 스플렁크는 안 해준다. 별도 서비스 등록 작업 필요.
[root@Centos7 opt] splunk/bin/splunk enable boot-startInit script installed at /etc/init.d/splunk.Init script is configured to run at boot.[root@Centos7 opt][root@Centos7 opt] chkconfig --list splunk
Note: This output shows SysV services only and does not include native systemd services. SysV configuration data might be overridden by native systemd configuration.
If you want to list systemd services use 'systemctl list-unit-files'. To see services enabled on particular target use 'systemctl list-dependencies [target]'.
splunk 0:off 1:off 2:on 3:on 4:on 5:on 6:offboot-start 옵션을 활성화시키면 서비스 등록과 함께, 시스템 기동 시 스플렁크 실행 설정까지 완료된다. 참고로 해당 작업을 할 때는 root 권한이 필요함. 이제 서비스 명령어를 이용해서 관리 가능.
[root@Centos7 opt] service splunk statusSplunk status:splunkd is running (PID: 1553).splunk helpers are running (PIDs: 1560 1643 1746 1757).[root@Centos7 opt][root@Centos7 opt] service splunk stopStopping splunk (via systemctl): [ OK ][root@Centos7 opt][root@Centos7 opt] service splunk startStarting splunk (via systemctl): [ OK ]참고로 인덱서와 포워더를 같은 시스템에 설치한 후, 순서대로 서비스 등록을 실행하면 마지막에 등록된 서비스가 먼저 등록된 서비스를 덮어쓴다. (v9부터는 따로 설치됨) 어차피 같은 시스템에 둘 다 설치할 일은 없으니 상관 없음.
아직 안 끝났다. 다음은 /opt/splunk/var/log/splunk/splunkd.log 내역. ulimit 관련 경고 메시지가 보인다.
09-06-2021 19:45:13.706 +0900 WARN ulimit [2840 MainThread] - Core file generation disabled.09-06-2021 19:45:13.706 +0900 INFO ulimit [2840 MainThread] - Limit: data file size: unlimited09-06-2021 19:45:13.706 +0900 INFO ulimit [2840 MainThread] - Limit: open files: 4096 files09-06-2021 19:45:13.706 +0900 INFO ulimit [2840 MainThread] - Limit: user processes: 7015 processes09-06-2021 19:45:13.706 +0900 INFO ulimit [2840 MainThread] - Limit: cpu time: unlimited09-06-2021 19:45:13.706 +0900 INFO ulimit [2840 MainThread] - Linux transparent hugepage support, enabled="always" defrag="always"09-06-2021 19:45:13.706 +0900 WARN ulimit [2840 MainThread] - This configuration of transparent hugepages is known to cause serious runtime problems with Splunk. Typical symptoms include generally reduced performance and catastrophic breakdown in system responsiveness under high memory pressure. Please fix by setting the values for transparent huge pages to "madvise" or preferably "never" via sysctl, kernel boot parameters, or other method recommended by your Linux distribution.엘라스틱은 RPM 설치 시 시스템 자원 할당을 자동으로 해주는데, 스플렁크는 별도 설정이 필요하다.
관련 글
댓글 없음:
댓글 쓰기