How do I tell Filebeat to use a specific NIC to send out harvested logs to Logstash? - filebeat

We have three Network Interface Card (NIC) in each of our machines running RedHat Linux. I want Filebeat to use a specific NIC/IP to send out data to Logstash. I cannot find anything in Filebeat config file related to this. Would it be setup in RedHat somewhere?

It looks like there is an option to set the specific host and IP for the logstash output, but not a specific NIC. elastic.co/guide/en/beats/filebeat/current/logstash-output.html I would therefore think that this would be a RedHat setting to tell Filebeat which NIC that logstash output host and port is on. Maybe Filebeat tries to send to the host and port on all NICs, but I havent tried this scenario. But would recommend asking on the Elastic Forum for additional and maybe more targeted insights and replies and assistance discuss.elastic.co

Related

Log the inbound traffic to the VM

We are planning to migrate the workloads from a Windows Server based virtual machine. I wanted to capture all the inbound connections to this VM so that the dependencies are properly addressed after the migration to the new VM.
Reason for this is, the present VM is there since ages there are many other applications connects to this using IP / VM name / DNS alias.
I know netstat can be used, I wanted to run some kind of a process for about 2 days continuously and monitor and log the inbound so that the results can be reviewed.
or let me know any better way to accomplish this.
than you in advance.
Regards,
Pradeep
I tried netstat but looking something that can run continuously and log the appropriate results

i'm not able to do Publisher/Subscriber in rabbitmq in ubuntu22.04, i'm not finding anything about it

i'm not able to do Publisher/Subscriber in rabbitmq in ubuntu22.04, i'm not finding anything about it. I use docker for this, I can create the management with port 8080:15672, I cannot use 5672. And when I send some code to Publisher/Subscriber nothing appears in the management, (obs: I used http//localhost:8080 to access rabbitmq management)
Did you open traffic redirection to port 5672? For eg. If you are using docker run, then -p 5672:5672

Wireguard with dynamic setup for iot

At the moment we have multiple raspberry pies placed at different locations on different networks.
Our current solution to be able to reach them if something goes wrong is auto-ssh with jump host.
Recently I stumbled on Wireguard which could be another more slim way to solve the calling home problem.
The problem is that we would like the setup phase to be more dynamic, we don't want to do special configuration per node we have out there, we just want them to call home with a key and then be apart of the network.
Two questions:
Is Wireguard for us or are there other problems that I can't foresee here.
Is there a way to set it up dynamically with one key and let the clients get random ips?
wireguard always needs a unique keypair / host. So not what you are looking for.
If you just want a phone home option with ip connectivity I would suggest an openvpn server and client. If you use a username/password config (not using certificates), you can reuse the config on multiple clients. Openvpn will act as an dhcp server.
an howto:
https://openvpn.net/community-resources/how-to/
search for:
client-cert-not-required
The option that Maxim Sagaydachny is also valid for command access, an alternative to salt could be puppet with mco/bolt.
On any option you choose, be sure that the daemon restarts when it crashes, reboots, fails...
for systemd services this would be an override with:
[service]
restart=always

Mesos Failed to connect error to IP:5050

I am new to Mesos and just finished setting up mesos and along with zookeeper on my test server.
Unfortunately I keep getting this error message on my mesos console indicating i am unable to connect to mesos on port 5050 and can't seem to figure out why.
I have included the error in the screen shot below
The mesos log files doesn't point to why the error is showing either.
I resolved the problem by this:
./bin/mesos-master.sh --ip=x.x.x.x --work_dir=/var/lib/mesos --hostname=x.x.x.x
We can avoid this problem by starting mesos-master with following option:
--ip=xx.xx.xx.xx --hostname_lookup=false
I have resolved this problem. Open the web page in Chrome, and open the developer tool, you will see the chrome is accessing the web site with domain, in my case the domain name is "mesosphere", as there is no mesosphere in dns, so the accessing was failed.
I solved the problem by adding the mesosphere in the hosts file, C:/windows/system32/etc/hosts/
If you use the domain name for the Mesos cluster you must set the domain name in windows hosts.
There can be multiple issues here.
Is your mesos-master running and healthy ?
Has leader election process completed, if all is good.
Check if you are able to do
ping leader.mesos
If above ping doesn't work, that means leader has not been elected. First fix that.
I had this problem also. Luckily, I have a running mesos server also. So, I can compare the different between my demo and the running mesos server. I captured the packets between client and server in my demo. I found the explorer didn`t resend fresh request, only some keepalive packets.
but, when I catch the packets in the running mesos server, I found the explorer send get request frequently. like the image
I think, if you run some task or add some agent, maybe it will activate the explore to send request frequently. Then the "Failed to connect" will disappeared.
I was having the same issues and what fixed it for me was the zookeeper configuration. In my case I was using the EC2 public IP Address rather than the private one. Once I changed the /etc/mesos/zk file to zk://<private IP>:2181/mesos I was able to connect without the constant error messages. In other words, zookeeper was reporting to be running in one IP and mesos-master was trying to connect using a different IP.
My configuration was correct as suggested. But failed to start mesos-master service. But There is alternative way to start mesos-master node with exact same configuration. Commands to start mesos-master
$ cd /usr/sbin [or mesos_installation directory/bin]
$sudo ./mesos-master --work_dir=/var/lib/mesos --log_dir=/home/rajeev/logs/mesos/
Its start mesos-master service successfully for me.

Is it possible to associate clients dynamically in sensu?

I'am using open source tools for the first time. I would like to install sensu, All i want to know that is there any method in which i can add my newly provisioned service automatically to the sensu server.
#vineesha We can make this possible when using rabbit mq, please write a script to fetch hostname and Ip address and update client.json and restart rabbitmq server and sensu-client. In the golden image please hard code the IP address of sensu server in rabbitmq.json. When all this is done please set a cron with #reboot and this should be all. When the server is launched it will automatically add to the sensu server.
If you are planning to use automation tools like for example puppet, all you need to do is to ensure that the sense-client is installed and the client config includes the correct RabbitMQ config.
As soon as the client connects to the same RabbitMQ host/cluster it should also pop up in you dashboard e.g. uchiwa.
There is no need to explicitly give the sense-server any information directly.