Rocky Linux 8にNetdata監視ツールをインストールし、サービスを監視する方法

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --permanent --list-services

cockpit dhcpv6-client ssh

$ sudo firewall-cmd --permanent --add-service=http
$ sudo firewall-cmd --permanent --add-service=https

$ sudo firewall-cmd --permanent --list-services

cockpit dhcpv6-client http https ssh

$ sudo firewall-cmd --reload

$ bash <(curl -Ss https://my-netdata.io/kickstart.sh)

$ sudo systemctl status netdata
? netdata.service - リアルタイムパフォーマンス監視
   Loaded: loaded (/usr/lib/systemd/system/netdata.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2022-04-11 12:09:12 UTC; 13s ago
 Main PID: 19443 (netdata)
    Tasks: 32 (limit: 11412)
   Memory: 52.0M
   CGroup: /system.slice/netdata.service
           ??19443 /usr/sbin/netdata -P /var/run/netdata/netdata.pid -D
           ??19448 /usr/sbin/netdata --special-spawn-server
           ??19937 /usr/libexec/netdata/plugins.d/apps.plugin 1
           ??19944 /usr/libexec/netdata/plugins.d/go.d.plugin 1

Apr 11 12:09:12 netdata systemd[1]: Started Real time performance monitoring.
.......

$ sudo systemctl enable netdata --now

$ sudo ss -plnt

State            Recv-Q           Send-Q                     Local Address:Port                      Peer Address:Port           Process
LISTEN           0                128                            127.0.0.1:8125                           0.0.0.0:*               users:(("netdata",pid=22496,fd=29))
LISTEN           0                128                              0.0.0.0:19999                          0.0.0.0:*               users:(("netdata",pid=22496,fd=6))
......
LISTEN           0                128                                [::1]:8125                              [::]:*               users:(("netdata",pid=22496,fd=28))
LISTEN           0                128                                 [::]:19999                             [::]:*               users:(("netdata",pid=22496,fd=7))

$ sudo dnf install epel-release

$ sudo dnf install certbot

$ sudo certbot certonly --standalone --agree-tos --no-eff-email --staple-ocsp --preferred-challenges http -m [email protected] -d netdata.example.com

$ sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

$ sudo mkdir -p /var/lib/letsencrypt

$ sudo nano /etc/cron.daily/certbot-renew

#!/bin/sh
certbot renew --cert-name netdata.example.com --webroot -w /var/lib/letsencrypt/ --post-hook "systemctl reload nginx"

$ sudo chmod +x /etc/cron.daily/certbot-renew

$ sudo nano /etc/yum.repos.d/nginx.repo

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

$ sudo dnf install nginx httpd-tools

$ nginx -v
nginx version: nginx/1.20.2

$ sudo systemctl enable nginx --now

$ sudo nano /etc/nginx/conf.d/netdata.conf

# Define netdata upstream
upstream netdata {
    server 127.0.0.1:19999;
    keepalive 64;
}

# Redirect all non-encrypted to encrypted
server {
    listen 80;
    listen [::]:80;
    server_name netdata.example.com;
    return 301 https://netdata.example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    
    server_name netdata.example.com;

    ssl_certificate     /etc/letsencrypt/live/netdata.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/netdata.example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/netdata.example.com/chain.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;
    ssl_prefer_server_ciphers off;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001] 8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] valid=60s;
    resolver_timeout 2s;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    access_log /var/log/nginx/netdata.example.com.access.log main;
    error_log  /var/log/nginx/netdata.example.com.error.log;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
     proxy_pass http://netdata;
     proxy_http_version 1.1;
        proxy_pass_request_headers on;
        proxy_set_header Connection "keep-alive";
        proxy_store off;
        auth_basic "NetData Private Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

$ sudo nano /etc/nginx/nginx.conf

server_names_hash_bucket_size  64;

$ sudo htpasswd -c /etc/nginx/.htpasswd netadmin
New password: 
Re-type new password: 
Adding password for user netadmin

$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ sudo systemctl restart nginx

$ sudo nano /etc/netdata/netdata.conf

[global]
..
        history = 14400
..

$ sudo touch /etc/netdata/.opt-out-from-anonymous-statistics

$ sudo systemctl restart netdata

$ sudo nano /etc/netdata/netdata.conf

[global]
...
    memory mode = dbengine
    page cache size = 32
    dbengine disk space = 256

$ sudo nano /etc/netdata/netdata.conf

[global]
...
    update every = 5

$ cd /etc/netdata

$ sudo ./edit-config health_alarm_notify.conf

# Enable slack notification
SEND_SLACK="YES"

# Select the slack webhook
SLACK_WEBHOOK_URL="https://hooks.slack.com/services/xxxxxxx"

# Default channel for notification
DEFAULT_RECIPIENT_SLACK="notifications"

$ sudo systemctl restart netdata

$ sudo dnf install msmtp

$ sudo nano /etc/msmtprc

# Set default values for all following accounts.
defaults

# Use the mail submission port 587 instead of the SMTP port 25.
port 587

# Always use TLS.
tls on

# The SMTP server of your ISP
account ses
host email-smtp..amazonaws.com
from [email protected]
auth on
user 
password 

# Set default account to isp
account default: ses

$ sudo nano /etc/netdata/health_alarm_notify.conf

# external commands

# The full path to the sendmail command.
# If empty, the system $PATH will be searched for it.
# If not found, email notifications will be disabled (silently).
sendmail="/usr/bin/msmtp"

# email global notification options

# multiple recipients can be given like this:
#              "[email protected] [email protected] ..."

# the email address sending email notifications
# the default is the system user netdata runs as (usually: netdata)
# The following formats are supported:
# EMAIL_SENDER="user@domain"
# EMAIL_SENDER="User Name "
# EMAIL_SENDER="'User Name' "
# EMAIL_SENDER="\"User Name\" "
EMAIL_SENDER="Server Admin <[email protected]>"

# enable/disable sending emails
SEND_EMAIL="YES"

# if a role recipient is not configured, an email will be send to:
DEFAULT_RECIPIENT_EMAIL="[email protected]"
# to receive only critical alarms, set it to "root|critical"

$ sudo su -s /bin/bash netdata

$ /usr/libexec/netdata/plugins.d/alarm-notify.sh test

$ exit.

$ cd /etc/netdata
$ sudo ./edit-config health.d/cpu.conf

warn: $this > (($status >= $WARNING)  ? (60) : (70))
crit: $this > (($status == $CRITICAL) ? (75) : (85))

$ sudo systemctl restart netdata

$ sudo dnf install stress

$ stress --cpu 2

$ nginx -V 2>&1 | grep -o with-http_stub_status_module
with-http_stub_status_module

$ sudo nano /etc/nginx/conf.d/default.conf

# Enable module stub_status
location /stub_status {
    stub_status;
    allow 127.0.0.1;        #only allow requests from localhost
    deny all;               #deny all other hosts
}

$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ sudo systemctl restart nginx

$ sudo systemctl restart netdata

$ cd /etc/netdata

$ sudo ./edit-config python.d/web_log.conf

# -------------------------------------------
# nginx log on various distros

# debian, arch
nginx_log:
  name: 'nginx'
  path: '/var/log/nginx/access.log'

# gentoo
nginx_log2:
  name: 'nginx_site'
  path: '/var/log/nginx/localhost.access_log'

# -------------------------------------------
# nginx log on various distros

# debian, arch
nginx_log:
  name: 'nginx'
  path: '/var/log/nginx/access.log'

nginx_log2:
  name: 'nginx_site1'
  path: '/var/log/nginx/site1.access_log'

nginx_log3:
  name: 'nginx_site2'
  path: '/var/log/nginx/site2.access_log'

nginx_log4:
  name: 'nginx_site3'
  path: '/var/log/nginx/site3.access_log'

$ sudo usermod -aG adm netdata

$ sudo systemctl restart nginx netdata

$ sudo nano /etc/yum.repos.d/MariaDB.repo

# MariaDB 10.6 CentOS repository list - created 2022-04-12 11:12 UTC
# https://mariadb.org/download/
[mariadb]
name = MariaDB
baseurl = https://download.nus.edu.sg/mirror/mariadb/yum/10.6/centos8-amd64
module_hotfixes=1
gpgkey=https://download.nus.edu.sg/mirror/mariadb/yum/RPM-GPG-KEY-MariaDB
gpgcheck=1

$ sudo dnf install MariaDB-server

$ sudo systemctl enable mariadb

$ sudo mariadb-secure-installation
....
Enter current password for root (enter for none): (Press Enter)
....
Switch to unix_socket authentication [Y/n] Y (Type Y and Press Enter)
....
Change the root password? [Y/n] Y (Type Y and Press Enter)
New password: 
Re-enter new password: 
Password updated successfully!
....
Remove anonymous users? [Y/n] Y (Type Y and Press Enter)
....
Disallow root login remotely? [Y/n] Y (Type Y and Press Enter)
....
Remove test database and access to it? [Y/n] Y (Type Y and Press Enter)
....
Reload privilege tables now? [Y/n] Y (Type Y and Press Enter)
....
All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

$ sudo nano /etc/my.cnf.d/server.cnf

[mariadb]
userstat = 1

$ sudo systemctl start mariadb

$ sudo systemctl restart netdata

$ sudo dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm

$ dnf module list php -y
Last metadata expiration check: 0:00:12 ago on Fri 03 Dec 2021 09:39:32 AM UTC.
Rocky Linux 8 - AppStream
Name                Stream                 Profiles                                 Summary
php                 7.2 [d]                common [d], devel, minimal               PHP scripting language
php                 7.3                    common [d], devel, minimal               PHP scripting language
php                 7.4                    common [d], devel, minimal               PHP scripting language

Remi's Modular repository for Enterprise Linux 8 - x86_64
Name                Stream                 Profiles                                 Summary
php                 remi-7.2               common [d], devel, minimal               PHP scripting language
php                 remi-7.3               common [d], devel, minimal               PHP scripting language
php                 remi-7.4               common [d], devel, minimal               PHP scripting language
php                 remi-8.0               common [d], devel, minimal               PHP scripting language
php                 remi-8.1               common [d], devel, minimal               PHP scripting language

Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

$ sudo dnf module reset php -y
$ sudo dnf module enable php:remi-8.0

$ sudo dnf install php php-fpm php-mbstring php-xml php-curl php-mysqlnd php-zip php-intl php-bcmath php-gd php-ldap php-cli

$ php --version
PHP 8.0.16 (cli) (built: Feb 15 2022 21:34:32) ( NTS gcc x86_64 )
Copyright (c) The PHP Group
Zend Engine v4.0.16, Copyright (c) Zend Technologies
    with Zend OPcache v8.0.16, Copyright (c), by Zend Technologies

$ sudo nano /etc/php-fpm.d/www.conf

...
; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
;       will be used.
; RPM: apache user chosen to provide access to the same directories as httpd
user = nginx
; RPM: Keep a group allowed to write in log dir.
group = nginx
...

; Note: There is a real-time FPM status monitoring sample web page available
;       It's available in: @EXPANDED_DATADIR@/fpm/status.html
;
; Note: The value must start with a leading slash (/). The value can be
;       anything, but it may not be a good idea to use the .php extension or it
;       may conflict with a real PHP file.
; Default Value: not set
pm.status_path = /status

$ sudo systemctl enable php-fpm --now

$ sudo nano /etc/nginx/conf.d/default.conf

# define PHP-FPM monitoring
location ~ ^/(status|ping)$ {
    allow 127.0.0.1;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_pass   unix:/run/php-fpm/.sock; # Depends on the PHP Version and OS Distro
}

$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ sudo systemctl restart nginx

$ sudo systemctl restart netdata

$ sudo dnf install yum-utils
$ sudo yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo
$ sudo dnf install docker-ce docker-ce-cli containerd.io

$ sudo systemctl enable docker --now

$ sudo nano /etc/docker/daemon.json

{
  "metrics-addr" : "127.0.0.1:9323",
  "experimental" : true
}

$ sudo systemctl restart docker netdata

$ docker container run -d nginx

$ docker ps
CONTAINER ID   IMAGE     COMMAND                  CREATED         STATUS         PORTS     NAMES
938b2cf30927   nginx     "/docker-entrypoint.…"   3 seconds ago   Up 2 seconds   80/tcp    pensive_lovelace

$ sudo systemctl restart netdata