宅EdgerouterXへアクセスしているIPアドレスをGrafa自naで地図上にプロットしてみた。

backend
:
├── rsyslog
│ ├── Dockerfile
│ └── build
│ ├── nginx_rule.dat
│ ├── router_rule.dat
│ └── rsyslog.conf

FROM alpine
LABEL version="1.0" "akiboi.net"="akiboI"
 
RUN apk add --update --no-cache rsyslog rsyslog-mmdblookup rsyslog-mmnormalize liblognorm tzdata && \
  cp /usr/share/zoneinfo/Asia/Tokyo /etc/localtime && \
  apk del tzdata
RUN mkdir /var/lib/geodb && \
  mkdir /etc/rsyslog.d
COPY build/rsyslog.conf /etc
COPY build/*_rule.dat /etc/rsyslog.d
 
#
CMD ["rsyslogd","-f","/etc/rsyslog.conf","-n"]

rule=: [%dummy0:word% %dummy1:word% %dummy2:word% SRC=%clientip:ipv4% %dummy3:rest%

#### Global directives ####
 
# Sets the directory that rsyslog uses for work files.
$WorkDirectory /var/lib/rsyslog
 
# Sets default permissions for all log files.
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
 
#### Modules ####
module(load="imudp")
module(load="mmnormalize")
module(load="mmdblookup")
 
#### Input ####
input(type="imudp" port="52200")
 
template( name="etcfile" type="string" string="/var/log/rsyslog/%hostname%/%programname%_msg.log")
template( name="locationlog" type="string" string="%timegenerated:::date-rfc3339% %hostname% %programname%: \"%$!iplocation!continent!code%\" \"%$!iplocation!continent!names!en%\" \"%$!iplocation!country!iso_code%\" \"%$!iplocation!country!names!en%\" \"%$!iplocation!city!names!en%\" \"%$!iplocation!location!latitude%\" \"%$!iplocation!location!longitude%\"%msg%\n")
template(name="all-json" type="list"){
  property(name="$!all-json")
}
 
if $programname == "proxy_access" or $programname == "web_access" then {
    if $msg startswith " -" or $msg startswith " 192.168.1" or $msg startswith " 127.0.0"  or $msg startswith " 24●●:●●●●:●●●●:●●●●" then {
        action(type="omfile" dynaFile="etcfile")
    }
    else {
        action(type="mmnormalize" rulebase="/etc/rsyslog.d/nginx_rule.dat")
        action(type = "mmdblookup" mmdbfile = "/var/lib/geodb/GeoLite2-City.mmdb"
             fields=["!continent!code","!continent!names!en","!country!iso_code","!country!names!en","!city!names!en","!location!latitude","!location!longitude"] key="!clientip" )
        action(type="omfile" template="locationlog" File="/var/log/rsyslog/nginx_access.log")
#        action(type="omfile" template="all-json" File="/var/log/nginx_json_access.log")
    }
} else if $hostname == "akiboiRT" and $programname == "kernel" then {
    if ($msg contains "[DSLite" or $msg contains "[PPPoE" or $msg contains "[WANv6") and not ($msg contains "DST=255.255.255.255") then {
        action(type="mmnormalize" rulebase="/etc/rsyslog.d/router_rule.dat")
        action(type = "mmdblookup" mmdbfile = "/var/lib/geodb/GeoLite2-City.mmdb"
            fields=["!continent!code","!continent!names!en","!country!iso_code","!country!names!en","!city!names!en","!location!latitude","!location!longitude"] key="!clientip" )
        action(type="omfile" template="locationlog" File="/var/log/rsyslog/router_access.log")
#       action(type="omfile" template="all-json" File="/var/log/router_json_access.log")
    } else {
            action(type="omfile" dynaFile="etcfile")
    }
} else {
    action(type="omfile" dynaFile="etcfile")
}

grafana:
  stage: buildContainer
  only:
    changes:
      - backend/rsyslog/**/*
  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=rsyslog
    - VOLUME="-v $BASEDIR/$CONTAINER/data:/var/lib/geodb:Z -v $BASEDIR/$CONTAINER/log:/var/log:Z "
    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST mkdir -p $BASEDIR/$CONTAINER/data $BASEDIR/$CONTAINER/log
    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always --name $CONTAINER $VOLUME $REGISTRY/$CONTAINER

2021-03-06T18:00:42.776830+09:00 akiboiRT kernel: "NA" "North America" "MX" "Mexico" "Castanos" "26.504000" "-101.156600"...
2021-03-06T18:00:45.820711+09:00 akiboiRT kernel: "NA" "North America" "MX" "Mexico" "Castanos" "26.504000" "-101.156600"...
2021-03-06T18:01:10.228675+09:00 akiboiRT kernel: "EU" "Europe" "SE" "Sweden" "Örebro" "59.274000" "15.211900"...

backend
:
├── promtail
│ ├── Dockerfile
│ └── build
│ └── config.yml

FROM grafana/promtail
 
LABEL version="1.0" "akiboi.net"="akiboI"
 
COPY build/config.yml /etc/promtail

server:
  http_listen_port: 9080
  grpc_listen_port: 0
 
positions:
  filename: /tmp/positions.yaml
 
clients:
  - url: http://localhost:3100/loki/api/v1/push
 
scrape_configs:
  - job_name: nginx
    static_configs:
      - targets:
          - localhost
        labels:
          job: varlogs
          __path__: /var/log/rsyslog/nginx*.log
  - job_name: router
    static_configs:
      - targets:
          - localhost
        labels:
          job: varlogs
          __path__: /var/log/rsyslog/router*.log
    pipeline_stages:
      - regex:
          expression: '^(?P<time>.*) (?P<server>.*) (?P<facility>.*) "(?P<continetcd>.*)" "(?P<continent>.*)" "(?P<countrycd>.*)" "(?P<country>.*)" "(?P<city>.*)" "(?P<latitude>.*)" "(?P<longitude>.*)" .*]IN=(?P<IF>.*) OUT.*SRC=(?P<SRC>.*) DST=(?P<DST>.*) LEN.*PROTO=(?P<PROTO>.*) SPT=.*$'
      - labels:
          continetcd:
          continent:
          countrycd:
          country:
          city:
          latitude:
          longitude:
      - metrics:
          router_log_counter:
            type: Counter
            description: total number of router logs
            max_idle_duration: 24h
            config:
              match_all: true
              action: inc
      - labels:
          country:
      - metrics:
          router_log_country:
            type: Counter
            description: total number of router logs
            max_idle_duration: 24h
            source: country
            config:
              action: inc
      - labels:
          city:
      - metrics:
          router_log_city:
            type: Counter
            description: total number of router logs
            max_idle_duration: 24h
            source: city
            config:
              action: inc

backend
├── .gitlab-ci.yml ← add promtail,loki,victory
├── blackbox-exporter
│ └── Dockerfile
├── grafana
│ ├── Dockerfile
│ └── build
│ └── grafana.ini
├── loki ← add
│ ├── Dockerfile ← add
│ └── build
│ └── local-config.yaml ← add
├── pr1
│ ├── Dockerfile
│ ├── build
│ │ ├── conf.d
│ │ │ ├── default.conf
│ │ │ ├── header.conf
│ │ │ └── log.conf
│ │ ├── nginx.conf
│ │ └── vhost.d
│ │ ├── 01_ap-Server.conf
│ │ ├── 03_test-Server.conf
│ │ └── 99_default.conf
│ └── html
│ ├── index4.html
│ └── index6.html
├── prometheus
│ ├── Dockerfile
│ └── build
│ └── prometheus.yml ← add pormtail,victoria
├── promtail
│ ├── Dockerfile
│ └── build
│ └── config.yml
├── rsyslog
│ ├── Dockerfile
│ └── build
│ ├── nginx_rule.dat
│ ├── router_rule.dat
│ └── rsyslog.conf
├── snmp-exporter
│ ├── Dockerfile
│ └── build
│ └── snmp.yml
└── victoria ← add
└── Dockerfile ← add

:
promtail:
  stage: buildContainer
  only:
    changes:
      - backend/promtail/**/*
  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=promtail
    - VOLUME=" -v $BASEDIR/rsyslog/log:/var/log:ro " ← rsyslogのログを利用する。
    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always --name $CONTAINER $VOLUME $REGISTRY/$CONTAINER
 
loki:
  stage: buildContainer
  only:
    changes:
      - backend/loki/**/*
  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=loki
    - VOLUME="-v $BASEDIR/$CONTAINER/data:/victoria-metrics-data:Z "
    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST mkdir -p $BASEDIR/$CONTAINER/data
    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always -- name $CONTAINER $VOLUME $REGISTRY/$CONTAINER
 
lovictoriaki:
  stage: buildContainer
  only:
    changes:
      - backend/victoria/**/*
  script:
    - HOST="xxxx@yyyy"
    - POD="backend"
    - BASEDIR="/vol"
    - HOMEDIR=`pwd`
    - WORKDIR=`echo ${HOMEDIR} | sed -e "s/^\/home\/gitlab-runner/\/vol\/gitlab-runner\/data/g"`
    - CONTAINER=victoria
    - VOLUME=""
    - REGISTRY="registry.akiboi.net:5000"
    - ssh $HOST podman build -t $REGISTRY/$CONTAINER $WORKDIR/$POD/$CONTAINER
    - ssh $HOST podman push $REGISTRY/$CONTAINER
    - ssh $HOST podman stop -i $CONTAINER
    - ssh $HOST podman rm -i $CONTAINER
    - ssh $HOST podman run -dt --pod $POD --restart=always -- name $CONTAINER $VOLUME $REGISTRY/$CONTAINER
:

FROM grafana/loki
LABEL version="1.0" "akiboi.net"="akiboI"
 
COPY build/local-config.yaml /etc/loki

auth_enabled: false
 
server:
  http_listen_port: 3100
 
ingester:
  lifecycler:
    address: 127.0.0.1
    ring:
      kvstore:
        store: inmemory
      replication_factor: 1
    final_sleep: 0s
  chunk_idle_period: 5m
  chunk_retain_period: 30s
  max_transfer_retries: 0
 
schema_config:
  configs:
    - from: 2018-04-15
      store: boltdb
      object_store: filesystem
      schema: v11
      index:
        prefix: index_
        period: 168h
 
storage_config:
  boltdb:
    directory: /loki/index
 
  filesystem:
    directory: /loki/chunks
 
limits_config:
  enforce_metric_name: false
  reject_old_samples: true
  reject_old_samples_max_age: 168h
 
chunk_store_config:
  max_look_back_period: 0s
 
table_manager:
  retention_deletes_enabled: false
  retention_period: 0s

FROM victoriametrics/victoria-metrics
LABEL version="1.0" "akiboi.net"="akiboI"

scrape_configs:
: - job_name: 'promtail'
    static_configs:
      - targets:
          - localhost:9080
 
# Remote write configuration (for victoria)
remote_write:
  - url: http://localhost:8428/api/v1/write

<div style="background-image: url('https://xxx.xxx.xxx/bg01.jpg')">
  <div
    style="
    padding: 1rem;
    color: #fff;
    font-size:32px;
    font-family: sans-serif;
    font-weight:bold;
    text-align:center;
    text-shadow:
      0 0 5px #fff,
      0 0 10px #fff,
      0 0 20px #fff,
      0 0 40px #0ff,
      0 0 60px #0ff;
    "
  >
    EdgeRouterX monitoring
  </div>
</div>

$ podman exec -it grafana sh
grafana-cli plugins install grafana-worldmap-panel