ganglia Spoof with Modules or gmetric

简介:
spoof的作用是篡改metric包里主机IP, 主机名, metric名的信息.
例如我们要在A主机监控其他主机或应用, 同时通过A主机发送到网络上的metric接收者, 正常情况下, metric发出去会携带A主机的IP, 主机名. 那么就导致接收方会按照IP将信息写入A主机对应的RRD文件, 在gweb上显示时, 也会显示在A主机的监控项里面.
但实际上我们希望它写入其他主机对应的rrd文件.
如图1, 在不使用spoof时, 如果从a主机将b,c,d的监控数据发出去, 会写入a主机IP对应的rrd file.
ganglia Spoof with Modules or gmetric - 德哥@Digoal - PostgreSQL research
当使用spoof后, 我们可以纂改metric携带的IP, hostname, metric name.
因此可以从a主机发出, 并写入对应的rrd file. 如下图 :   
ganglia Spoof with Modules or gmetric - 德哥@Digoal - PostgreSQL research
在模块中使用变量 SPOOF_HOST and  SPOOF_NAME后, gmond会将这个数据包按照spoof来处理.
Spoofing with Modules
Spoofing is a concept that allows an instance of gmond running on one host to report
the metrics that it gathers as if they were coming from an instance of gmond running
on another host. In other words, gmond can fool the rest of Ganglia into thinking that
the metrics that it is gathering are really coming from somewhere else. Spoofing was a
concept originally designed and implemented as part of the gmetric utility. The idea of
being able to report metrics as if they originated somewhere else was so popular in
gmetric, that it only seemed natural to extend that idea into gmond modules as well.
Spoofing a metric within a gmond Python module is a matter of adding extra metadata
elements to the metric description. Each metric definition, as previously described, may
contain extra elements, which indicate to gmond that special handling of the metric is
required.  These  extra  elements  include  SPOOF_HOST and  SPOOF_NAME.  By  adding
SPOOF_HOST and  SPOOF_NAME to  a  metric  definition,  gmond  will  treat  the  metric  as  a
spoofed metric rather than an actual metric.
Because the concept of spoofing original came from the gmetric utility, the format of
the  SPOOF_HOSTand  SPOOF_NAMEvalues also follow the same format as defined by gmetric.
The SPOOF_HOSTextra element specifies the IP address and the hostname of the host for
which the metric should be reported. The format of the SPOOF_HOSTvalue must be the
IP address followed by the hostname separated by a colon (ip_address:host_name).
When gmond sees this extra element, it will automatically replace the originating IP
address  and  hostname  with  the  values  that  are  specified  by  this  element.  The
SPOOF_NAMEextra element is used to indicate to gmond that the metric definition should
assume the name of a different metric. In other words, if spoofing is being used to gather
the boot time of a remote host, the SPOOF_NAMEcan be set to boot_timeto indicate that
this metric is actually an alias of the standard boot_timemetric. This concept makes a
little more sense when you consider that each spoofed metric must also have a unique
name.
Let’s take the example of the  boot_time  metric. If you have a metric module that gathers
the boot time of not only the host on which it is currently running but also several other
remote hosts, the dictionary of metric definitions that is returned by this module must
include a metric definition for the local  boot_timemetric as well as each remote host
boot_time. Because gmond requires that every metric defined by a module have a unique
metric name, there would be no way to define three different metrics all with the same
boot_timemetric name. Therefore, in order to uniquely identify each metric by its name,
a common practice when defining a spoofed metric is to include the hostname as part
of the metric name (boot_time:my_host). But naming a metric in this way would cause
each of the remote host boot time metrics to show up in the web frontend as separate
metrics that don’t actually correspond to the boot time of the host. In order to fix this
problem, use the SPOOF_NAMEextra element to tell gmond that the metric definition is
actually an alias for the standard boot_timemetric.
Just to make sure that you got all of that, let’s summarize. Specifying  SPOOF_HOSTas part
of the metric definition tells gmond that this metric is a spoofed metric. The format of
its value should be the remote host IP address followed by the hostname separated by
a colon. Specifying  SPOOF_NAMEas part of the metric definition tells gmond that the spoof
name is really an alias for another metric. Finally, the name of each spoofed metric must
be unique. In addition to that, you will need to remember that when your metric callback function is called, the name parameter that is passed in will be the unique name
of the metric and not the SPOOF_NAME. By passing in the unique name, this helps your
callback function determine not only the metric it needs to gather but also the remote
host that it should gather the metric from.


使用gmetric来填写spoof信息 : 
  -S, --spoof=STRING    IP address and name of host/device (colon separated) we 
                          are spoofing  (default=`')
  -n, --name=STRING     Name of the metric

[root@150 data03]# gmetric -h
gmetric 3.6.0

The Ganglia Metric Client (gmetric) announces a metric
on the list of defined send channels defined in a configuration file

Usage: gmetric [OPTIONS]...

  -h, --help            Print help and exit
  -V, --version         Print version and exit
  -c, --conf=STRING     The configuration file to use for finding send channels 
                           (default=`/opt/ganglia-core-3.6.0/etc/gmond.conf')
  -n, --name=STRING     Name of the metric
  -v, --value=STRING    Value of the metric
  -t, --type=STRING     Either 
                          string|int8|uint8|int16|uint16|int32|uint32|float|double
  -u, --units=STRING    Unit of measure for the value e.g. Kilobytes, Celcius  
                          (default=`')
  -s, --slope=STRING    Either zero|positive|negative|both  (default=`both')
  -x, --tmax=INT        The maximum time in seconds between gmetric calls  
                          (default=`60')
  -d, --dmax=INT        The lifetime in seconds of this metric  (default=`0')
  -g, --group=STRING    Group(s) of the metric (comma-separated)
  -C, --cluster=STRING  Cluster of the metric
  -D, --desc=STRING     Description of the metric
  -T, --title=STRING    Title of the metric
  -S, --spoof=STRING    IP address and name of host/device (colon separated) we 
                          are spoofing  (default=`')
  -H, --heartbeat       spoof a heartbeat message (use with spoof option)


[参考]
目录
相关文章
|
12月前
|
人工智能 JSON 自然语言处理
基于阿里云通义千问的AI模型应用开发指南
阿里云通义千问是阿里巴巴集团推出的多模态大语言模型平台,提供了丰富的API和接口,支持多种AI应用场景,如文本生成、图像生成和对话交互等。本文将详细介绍阿里云通义千问的产品功能,并展示如何使用其API来构建一个简单的AI应用,包括程序代码和具体操作流程,以帮助开发者快速上手。
2394 3
|
弹性计算 前端开发 Java
通义千问API:让大模型写代码和跑代码
基于前面三章的铺垫,本章我们将展示大模型Agent的强大能力。我们不仅要实现让大模型同时使用多种查询工具,还要实现让大模型能查询天气情况,最后让大模型自己写代码来查询天气情况。
通义千问API:让大模型写代码和跑代码
|
XML 搜索推荐 API
通义千问API:让大模型使用各种工具
本章我们将通过一个简单的例子,揭示基于LangChain的Agent开发的秘密,从而了解如何扩展大模型的能力。
通义千问API:让大模型使用各种工具
|
机器学习/深度学习 算法 数据可视化
【模式识别】解锁降维奥秘:深度剖析PCA人脸识别技术
【模式识别】解锁降维奥秘:深度剖析PCA人脸识别技术
433 0
|
人工智能 自然语言处理 物联网
识别技术在数字经济时代的新发展
随着科技的进步,现代社会的发展可谓是日新月异,对我们的日常生活而言,感受最突出的一个方面,大概就是便利。
识别技术在数字经济时代的新发展
|
4天前
|
存储 关系型数据库 分布式数据库
PostgreSQL 18 发布,快来 PolarDB 尝鲜!
PostgreSQL 18 发布,PolarDB for PostgreSQL 全面兼容。新版本支持异步I/O、UUIDv7、虚拟生成列、逻辑复制增强及OAuth认证,显著提升性能与安全。PolarDB-PG 18 支持存算分离架构,融合海量弹性存储与极致计算性能,搭配丰富插件生态,为企业提供高效、稳定、灵活的云数据库解决方案,助力企业数字化转型如虎添翼!
|
15天前
|
弹性计算 关系型数据库 微服务
基于 Docker 与 Kubernetes(K3s)的微服务:阿里云生产环境扩容实践
在微服务架构中,如何实现“稳定扩容”与“成本可控”是企业面临的核心挑战。本文结合 Python FastAPI 微服务实战,详解如何基于阿里云基础设施,利用 Docker 封装服务、K3s 实现容器编排,构建生产级微服务架构。内容涵盖容器构建、集群部署、自动扩缩容、可观测性等关键环节,适配阿里云资源特性与服务生态,助力企业打造低成本、高可靠、易扩展的微服务解决方案。
1313 5
|
2天前
|
监控 JavaScript Java
基于大模型技术的反欺诈知识问答系统
随着互联网与金融科技发展,网络欺诈频发,构建高效反欺诈平台成为迫切需求。本文基于Java、Vue.js、Spring Boot与MySQL技术,设计实现集欺诈识别、宣传教育、用户互动于一体的反欺诈系统,提升公众防范意识,助力企业合规与用户权益保护。