Beats：如何安装Packetbeat

网络数据包分析器Packetbeat是第一个引入的beat。 Packetbeat捕获服务器之间的网络流量，因此可用于应用程序和性能监视。
Packetbeat可以安装在受监视的服务器上，也可以安装在其专用服务器上。 Packetbeat跟踪网络流量，解码协议并记录每笔交易的数据。 Packetbeat支持的协议包括：DNS，HTTP，ICMP，Redis，MySQL，MongoDB，Cassandra等。理解像Packetbeat这样的网络数据包分析系统的价值的最佳方法是根据自己的流量进行尝试。更多信息，请参阅Elastic的官方网站https://www.elastic.co/beats/packetbeat。

要开始您自己的Packetbeat设置，请安装和配置以下相关产品：

用于存储和索引数据的Elasticsearch
用户界面的Kibana

如果你还没有完成自己的Elasticsearch及Kibana的安装，请参阅我们之前的文章“Elastic：菜鸟上手指南”。

对于有经验的开发者来说，我们可以直接进入到Elastic公司的官网直接下载，并安装。下载地址为https://www.elastic.co/downloads/beats。当我们下载时，必须注意选择和自己Elasticsearch想匹配的版本。我们可以可以在自己的电脑上直接使用命令来进行安装。你可以根据自己的版本替换下面命令行中的7.6.1版本号码。

deb:

sudo apt-get install libpcap0.8
curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.6.1-amd64.deb
sudo dpkg -i packetbeat-7.6.1-amd64.deb

rpm:

sudo yum install libpcap
curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.6.1-x86_64.rpm
sudo rpm -vi packetbeat-7.6.1-x86_64.rpm

mac:

curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.6.1-darwin-x86_64.tar.gz
tar xzvf packetbeat-7.6.1-darwin-x86_64.tar.gz

brew:

brew tap elastic/tap
brew install elastic/tap/packetbeat-full

这将安装最新发行的Packetbeat默认发行版。要安装OSS发行版，请指定elastic/tap/packetbeat-oss。

linux:

curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.6.1-linux-x86_64.tar.gz
tar xzvf packetbeat-7.6.1-linux-x86_64.tar.gz

win:

下载并安装实现libpcap接口的数据sniffing库，例如Npcap。

如果使用Npcap，请确保以WinPcap API兼容模式安装它。如果您打算从loopback设备捕获流量（127.0.0.1流量），则还选择支持loopback流量的选项。

从下载页面下载Packetbeat Windows zip文件
将zip文件的内容提取到C:\Program Files
将packetbeat- <版本> -windows目录重命名为Packetbeat
以管理员身份打开PowerShell提示符（右键单击PowerShell图标，然后选择“以管理员身份运行”）。

在PowerShell提示符下，运行以下命令以将Packetbeat安装为Windows服务：

PS > cd 'C:\Program Files\Packetbeat'
PS C:\Program Files\Packetbeat> .\install-service-packetbeat.ps1

请注意：如果在系统上禁用了脚本执行，则需要为当前会话设置执行策略以允许脚本运行。例如：

PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-packetbeat.ps1

在使用Packetbeat之前，我们必须配置Packetbeat才可以使它正常工作。在Packetbeat的安装目录下，有一个叫做packetbeat.yml的配置文件（针对Linux的情况，它位于/etc/packetbeat/目录下）。在最简单的情况下，我们必须修改：

output.elasticsearch:
  hosts: ["myEShost:9200"]
  username: "filebeat_internal"
  password: "YOUR_PASSWORD" 
setup.kibana:
  host: "mykibanahost:5601"
  username: "my_kibana_user"  
  password: "YOUR_PASSWORD"

我们需要把Elasticsearch及Kibana的地址填入到上面的位置。这样我们我们就可以把数据传入到Elasticsearch中，并在Kibana中的Dashboard中进行展示。更多的配置请参阅Elastic的官方文档“Configure Packetbeat”。

等修改完我们的packetbeat.yml文件后，我们可以使用如下的命令来检查修改后的文件是否正确：

sudo packetbeat test config -e

如果你看到如下的类似的输出：

$ sudo packetbeat test config -e
2020-03-17T16:18:14.995+0800	INFO	instance/beat.go:622	Home path: [/usr/share/packetbeat] Config path: [/etc/packetbeat] Data path: [/var/lib/packetbeat] Logs path: [/var/log/packetbeat]
2020-03-17T16:18:14.995+0800	INFO	instance/beat.go:630	Beat ID: 7855ec98-8eb1-4639-a65f-936acfc2cabd
2020-03-17T16:18:14.996+0800	INFO	[beat]	instance/beat.go:958	Beat info	{"system_info": {"beat": {"path": {"config": "/etc/packetbeat", "data": "/var/lib/packetbeat", "home": "/usr/share/packetbeat", "logs": "/var/log/packetbeat"}, "type": "packetbeat", "uuid": "7855ec98-8eb1-4639-a65f-936acfc2cabd"}}}
2020-03-17T16:18:14.996+0800	INFO	[beat]	instance/beat.go:967	Build info	{"system_info": {"build": {"commit": "c1c49432bdc53563e63e9d684ca3e9843626e448", "libbeat": "7.6.1", "time": "2020-02-28T23:00:10.000Z", "version": "7.6.1"}}}
2020-03-17T16:18:14.996+0800	INFO	[beat]	instance/beat.go:970	Go runtime info	{"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":6,"version":"go1.13.8"}}}
2020-03-17T16:18:14.996+0800	INFO	[beat]	instance/beat.go:974	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-03-17T05:49:48+08:00","containerized":false,"name":"liuxg","ip":["127.0.0.1/8","::1/128","192.168.43.192/24","fe80::4335:a826:a61b:c231/64"],"kernel_version":"5.3.0-40-generic","mac":["08:00:27:2a:f0:fa"],"os":{"family":"debian","platform":"ubuntu","name":"Ubuntu","version":"18.04.4 LTS (Bionic Beaver)","major":18,"minor":4,"patch":4,"codename":"bionic"},"timezone":"CST","timezone_offset_sec":28800,"id":"aa0be63698ff4d65848345a09778d58b"}}}
2020-03-17T16:18:14.997+0800	INFO	[beat]	instance/beat.go:1003	Process info	{"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"ambient":null}, "cwd": "/etc/packetbeat", "exe": "/usr/share/packetbeat/bin/packetbeat", "name": "packetbeat", "pid": 5187, "ppid": 5186, "seccomp": {"mode":"disabled","no_new_privs":false}, "start_time": "2020-03-17T16:18:14.350+0800"}}}
2020-03-17T16:18:14.997+0800	INFO	instance/beat.go:298	Setup Beat: packetbeat; Version: 7.6.1
2020-03-17T16:18:14.997+0800	INFO	[index-management]	idxmgmt/std.go:182	Set output.elasticsearch.index to 'packetbeat-7.6.1' as ILM is enabled.
2020-03-17T16:18:14.997+0800	INFO	elasticsearch/client.go:174	Elasticsearch url: http://192.168.43.220:9200
2020-03-17T16:18:14.997+0800	INFO	[publisher]	pipeline/module.go:110	Beat name: liuxg
2020-03-17T16:18:14.997+0800	INFO	procs/procs.go:105	Process watcher disabled
Config OK

则表明我们的配置是成功的。

等配置完我们的Packetbeat，并配置完后我们运行如下的命令进行setup (Linux):

sudo packetbeat setup

$ sudo packetbeat setup
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling.

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

上面显示我们已经成功地安装了dashboard及配置Index。

接下来我们使用如下的命令来启动这个packetbeat的服务（Linux)：

sudo service packetbeat start

我们可以在Linux下查看这个服务：

$ systemctl status packetbeat
● packetbeat.service - Packetbeat analyzes network traffic and sends the data to Elasticsearch.
   Loaded: loaded (/lib/systemd/system/packetbeat.service; disabled; vendor preset: enabled)
   Active: active (running) since Tue 2020-03-17 16:02:56 CST; 38s ago
     Docs: https://www.elastic.co/products/beats/packetbeat
 Main PID: 4355 (packetbeat)
    Tasks: 15 (limit: 4915)
   CGroup: /system.slice/packetbeat.service
           └─4355 /usr/share/packetbeat/bin/packetbeat -e -c /etc/packetbeat/packetbeat.yml -path.ho

上面显示我们的packetbeat正在运行正常。

这个时候打开我们的Kibana，并选择Dashboard:

点击上面的[Packetbeat] Flow ECS：

如果你已经看见上面的一些数据，则表明我们的Packetbeat已经是安装正确的。

参考：

【1】https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-installation.html

Elastic 中国社区官方博客企业博客

发布了512 篇原创文章 · 获赞 124 · 访问量 90万+

他的留言板关注

Beats：如何安装Packetbeat

猜你喜欢