如下图所示
(图片点击放大查看)
在Graylog集群环境上，日志源将日志发送到负载均衡，由负载均衡来分配日志发送到GrayLog具体哪个节点上，实现各节点接入能力和处理能力平衡均分
(图片点击放大查看)
下面采用nginx作为GrayLog 日志接入的负载均衡
1、配置nginx 的yum源
参考nginx官方文档
http://nginx.org/en/linux_packages.html#RHEL
具体命令如下
vim /etc/yum.repos.d/nginx.repo 添加如下行 [nginx-stable] name=nginx stable repo baseurl=http://nginx.org/packages/centos/$releasever/$basearch/ gpgcheck=0 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true [nginx-mainline] name=nginx mainline repo baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/ gpgcheck=0 enabled=0 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true
(图片点击放大查看)
安装nginx
yum install nginx --enablerepo=nginx-stable --disablerepo=epel
(图片点击放大查看)
(图片点击放大查看)
2、配置nginx下stream配置文件
vim /etc/nginx/nginx.conf 将http字段中的include /etc/nginx/conf.d/*.conf;移到上方
(图片点击放大查看)
然后
cd /etc/nginx/conf.d/ mv default.conf /opt vim graylog_stream.conf
添加如下行
stream { log_format streamlog_json escape=json '{"timestamp":"$time_iso8601",' '"remote_addr":"$remote_addr",' '"protocol":"$protocol",' '"status":"$status",' '"bytes_sent":"$bytes_sent",' '"bytes_received":"$bytes_received",' '"session_time":"$session_time",' '"upstream_addr":"$upstream_addr",' '"upstream_bytes_sent":"$upstream_bytes_sent",' '"upstream_bytes_received":"$upstream_bytes_received",' '"upstream_connect_time":"$upstream_connect_time"' '}'; access_log /var/log/nginx/stream-access.log streamlog_json ; access_log syslog:server=10.10.253.101:2514 streamlog_json ; open_log_file_cache off; upstream graylog_servers{ server 10.10.253.101:9000; server 10.10.253.102:9000 backup; server 10.10.253.103:9000 backup; } server { listen 9000; proxy_pass graylog_servers; } upstream server_input1_switchlog { server 10.10.253.101:1515; server 10.10.253.102:1515; server 10.10.253.103:1515; } server { listen 1515 udp; proxy_pass server_input1_switchlog; } upstream server_input2_firewall-log { server 10.10.253.101:1514; server 10.10.253.102:1514; server 10.10.253.103:1514; } server { listen 1514 udp; proxy_pass server_input2_firewall-log; } }
3、启动nginx服务
systemctl enable nginx systemctl start nginx firewall-cmd --add-port=1514/udp --permanent firewall-cmd --add-port=1515/udp --permanent firewall-cmd --add-port=9000/tcp --permanent firewall-cmd --reload
(图片点击放大查看)
这样就可以用nginx来实现接入日志时的负载均衡效果
