ins tuts de recherche du CNRS Physique Nucléaire et des Par cules 20 Labos répar s sur la France C'est L'U lisateur IT historique du CCIN2P3 Impliqué dans le LHC
flux d'événements (streams) Événement ( t i m e , h o s t , s e r v i c e , s t a t e , t t l , t a g s , a t t r i b u t e s ) Ecrit en clojure Protobuf Fichier de config en clojure \o/ Aggréga on d'événements, routage, aler ng, tout est possible "super statsd" index en mémoire de tous les événements récents ( h o s t , s e r v i c e )
o c k d e s t i n a t i o n r t m o n ( h o s t ( ) p o r t ( 5 5 5 5 ) t y p e ( " u d p " ) t h r o t t l e ( 0 ) ) { r i e m a n n ( t h r o t t l e ( ` t h r o t t l e ` ) s e r v e r ( ` h o s t ` ) p o r t ( ` p o r t ` ) t y p e ( ` t y p e ` ) f l u s h l i n e s ( 1 ) t t l ( " $ { t t l : 3 0 0 } " ) h o s t ( " $ H O S T " ) d e s c r i p t i o n ( " $ M E S S A G E " ) s t a t e ( " $ { s t a t e : o k } " ) a t t r i b u t e s (
i n " w r i t e _ r i e m a n n " > A t t r i b u t e " f a c t e r . o s f a m i l y " " R e d H a t " A t t r i b u t e " f a c t e r . o p e r a t i n g s y s t e m m a j r e l e a s e " " 6 " A t t r i b u t e " f a c t e r . p r o d u c t n a m e " " O p e n S t a c k N o v a " T a g " c o l l e c t d " < N o d e " c o l o s s " > T t l f a c t o r 4 . 0 A l w a y s A p p e n d D s f a l s e C h e c k T h r e s h o l d s t r u e H o s t " c c o s v m 0 9 1 7 " N o t i f i c a t i o n s f a l s e P o r t " 5 5 5 5 " P r o t o c o l " T C P " S t o r e R a t e s t r u e < / N o d e > < / P l u g i n >
i n " t h r e s h o l d " > < P l u g i n " d f " > < T y p e " p e r c e n t _ b y t e s " > F a i l u r e M i n 0 . 5 I n s t a n c e " f r e e " I n t e r e s t i n g f a l s e P e r c e n t a g e f a l s e P e r s i s t f a l s e W a r n i n g M i n 4 < / T y p e > < / P l u g i n > < / P l u g i n >
p t e r l e n o m b r e t o t a l d ' u t i l i s a t e u r s ( w h e r e ( s e r v i c e " u s e r s / u s e r s " ) ( c o a l e s c e 1 5 ( s m a p f o l d s / s u m ( w i t h { : t t l 1 2 0 : h o s t n i l : s e r v i c e " t o t a l u s e r s " } i n d e x e r ) ) ) ) ; c a l c u l e r l e p o u r c e n t a g e d e d a t a g r a m m e s p e r d u s ( p r o j e c t [ ( s e r v i c e " p r o t o c o l s U d p / p r o t o c o l _ c o u n t e r I n E r r o r s " ) ( s e r v i c e " p r o t o c o l s U d p / g a u g e I n T o t a l " ) ] ( s m a p f o l d s / q u o t i e n t s l o p p y ( w i t h { : s e r v i c e " p r o t o c o l s U d p / p e r c e n t I n E r r o r s " : t y p e _ i n s t a n c e " I n E r r o r s " : t y p e " p e r c e n t " : d s _ t y p e " g a u g e " } ( a d j u s t [ : m e t r i c * 1 0 0 ] ( s p l i t ( < 5 0 m e t r i c ) ( w i t h : s t a t e " c r i t i c a l " i n d e x e r ) ( < 2 m e t r i c ) ( w i t h : s t a t e " w a r n i n g " i n d e x e r )
m a i l s i n k ( t h r o t t l e 1 0 0 3 6 0 0 ( r o l l u p 2 3 6 0 0 ( e m a i l " a l a a a a r m @ c c . i n 2 p 3 . f r " ) ) ) [ n a g i o s s i n k ( n a g i o s { : h o s t " n a g i o s . p l e a s e . a l e r t . m e " : p o r t 5 6 6 7 : p a s s w o r d " s e c r e t " : e n c r y p t i o n T R I P L E _ D E S } ) ] ( s t r e a m s ( d e f a u l t : s t a t e " o k " ( w h e r e ( n o t ( s t a t e " o k " ) ) e m a i l s i n k ) ) ( w h e r e ( s e r v i c e " s o m e c r i t i c a l s e r v i c e " ) ( c h a n g e d : s t a t e n a g i o s s i n k ) ) ) )
1 0 6 4 … t + 3 0 0 5 samplerr 20s avg 60s min avg max 5m min avg max 1h min avg max cust 100GB delete after 1day 100GB delete after 2 days 100GB delete after 1 week 100GB delete after 10 years
g / i n i t { : f i l e " / v a r / l o g / r i e m a n n / r i e m a n n . l o g " } ) ( l o a d p l u g i n s ) ( l e t [ h o s t " 0 . 0 . 0 . 0 " ] ( t c p s e r v e r { : h o s t h o s t : p o r t 5 5 5 5 } ) ( u d p s e r v e r { : h o s t h o s t : p o r t 5 5 5 5 } ) ( w s s e r v e r { : h o s t h o s t : p o r t 5 5 5 6 } ) ) ( p e r i o d i c a l l y e x p i r e 1 2 0 ) ( r e q u i r e ' [ c l j t i m e . c o r e : a s t ] ) ( l e t [ e l a s t i c ( s a m p l e r r / c o n n e c t " h t t p : / / c c q s e r v m o n . i n 2 p 3 . f r : 9 2 0 0 " ) i n d e x ( i n d e x ) i n d e x p r e f i x " . c o l l e c t d " a l i a s p r e f i x " c o l l e c t d " c f u n c [ { : f u n c s a m p l e r r / a v e r a g e : n a m e " a v g " } { : f u n c s a m p l e r r / m i n i m u m : n a m e " m i n " } { : f u n c s a m p l e r r / m a x i m u m : n a m e " m a x " } ] a r c h i v e s [ { : t f " Y Y Y Y . M M . d d " : s t e p ( t / s e c o n d s 2 0 ) : t t l ( t / d a y s 2 ) : c f u n c [ { : n a m e " a v g " : f u n c s a m p l e r r / a v e r a g e } ] } { : t f " Y Y Y Y . M M " : s t e p ( t / m i n u t e s 5 ) : t t l ( t / m o n t h s 2 ) : c f u n c c f u n c } { : t f " Y Y Y Y " : s t e p ( t / m i n u t e s 2 0 ) : t t l ( t / y e a r s 1 0 ) : c f u n c c f u n c } ] r o t a t e ( s a m p l e r r / p e r i o d i c a l l y r o t a t e { : i n t e r v a l ( t / h o u r s 1 ) : c o n n e l a s t i c : i n d e x p r e f i x i n d e x p r e f i x : a l i a s p r e f i x a l i a s p r e p u r g e ( s a m p l e r r / p e r i o d i c a l l y p u r g e { : i n t e r v a l ( t / d a y s 1 ) : c o n n e l a s t i c : i n d e x p r e f i x i n d e x p r e f i x : a r c h i v e s a r c h i v e s } ) p e r s i s t ( b a t c h 1 0 0 0 0 2 0 ( s a m p l e r r / p e r s i s t { : i n d e x p r e f i x i n d e x p r e f i x : i n d e x t y p e " s a m p l e r r " : c o n n e l a s t i c } ) ) ] ( s t r e a m s ( w h e r e ( t a g g e d " c o l l e c t d " ) ( b y [ : h o s t : s e r v i c e ] ( s a m p l e r r / d o w n a r c h i v e s p e r s i s t ) ) ) ) r o t a t e p u r g e )
p:/ /riemann.io/ h p:/ /search.cpan.org/~faxmodem/Collectd‐Plugins‐ Riemann h ps:/ /forge.puppet.com/ccin2p3/riemann h ps:/ /github.com/ccin2p3/samplerr/ h ps:/ /github.com/ccin2p3/loggmann h ps:/ /github.com/faxm0dem/riemann‐mbeans/ h p:/ /www.syslog‐ng.org/