centos7 moloch安装及优化

一、安装

1.1下载

wget https://files.molo.ch/builds/centos-7/moloch-1.5.2-1.x86_64.rpm

1.2 安装（按提示操作）

rpm -ivh moloch-1.5.2-1.x86_64.rpm

Instructions for using the prebuilt Moloch packages.
Please report any bugs or feature requests by opening an issue at https://github.com/aol/moloch/issues

Basic Moloch Installation steps:
1) Download a Moloch build for 64bit Ubuntu 14.04, Ubuntu 16.04, Centos 6, or Centos 7 from http://molo.ch/index.html#downloads
2) Install package
3) Configure basic moloch items by running the Configure script (this needs to be done only once)
/data/moloch/bin/Configure
4) The Configure script can install elasticsearch for you or you can install yourself
/sbin/start elasticsearch # for upstart/Centos 6/Ubuntu 14.04
systemctl start elasticsearch.service # for systemd/Centos 7/Ubuntu 16.04
5) Initialize/Upgrade Elasticsearch Moloch configuration
a) If this is the first install, or want to delete all data
/data/moloch/db/db.pl http://ESHOST:9200 init
b) If this is an update to moloch package
/data/moloch/db/db.pl http://ESHOST:9200 upgrade
6) Add an admin user if a new install or after an init
/data/moloch/bin/moloch_add_user.sh admin "Admin User" THEPASSWORD --admin
7) Start everything
a) If using upstart (Centos 6 or sometimes Ubuntu 14.04):
/sbin/start molochcapture
/sbin/start molochviewer
b) If using systemd (Centos 7 or Ubuntu 16.04 or sometimes Ubuntu 14.04)
systemctl start molochcapture.service
systemctl start molochviewer.service
8) Look at log files for errors
/data/moloch/logs/viewer.log
/data/moloch/logs/capture.log
9) Visit http://MOLOCHHOST:8005 with your favorite browser.
user: admin
password: THEPASSWORD from step #6

Any configuration changes can be made to /data/moloch/etc/config.ini
See https://github.com/aol/moloch/wiki/FAQ#moloch-is-not-working for issues

Additional information can be found at:
* https://github.com/aol/moloch/wiki/FAQ
* https://github.com/aol/moloch/wiki/Settings

二、优化

# 优化es
[root@moloch elasticsearch]# vim /etc/elasticsearch/jvm.options
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
-Xms32g
-Xmx32g

#抓包经常会把硬盘用完，当硬盘使用空间到80% es 就开始报警，直接把报警关掉的。

[root@moloch elasticsearch]# vim /etc/elasticsearch/elasticsearch.yml
cluster.routing.allocation.disk.threshold_enabled: false
network.host: 10.10.7.7

# 关于pcap的数据包我是使用moloch来控制删除
[root@moloch ~]# vim /data/moloch/etc/config.ini
# Delete pcap files when free space is lower then this in gigabytes OR it can be
# expressed as a percentage (ex: 5%). This does NOT delete the session records in
# the database. It is recommended this value is between 5% and 10% of the disk.
# Database deletes are done by the db.pl expire script
freeSpaceG = 5%

# es使用moloch自带的脚本来控制删除
[root@moloch db]# vi /data/moloch/db/daily.sh
#!/bin/sh
# This script is only needed for Moloch deployments that monitor live traffic.
# It drops the old index and optimizes yesterdays index.
# It should be run once a day during non peak time.
# CONFIG
ESHOSTPORT=CHANGEMEHOST:CHANGEMEPORT
RETAINNUMDAYS=7

/data/moloch/db/db.pl $ESHOSTPORT expire daily $RETAINNUMDAYS

# 在做个定时任务
[root@moloch ~]# crontab -e01 04 * * * /data/moloch/db/daily.sh >> /data/moloch/logs/daily.log 2>&1

高性能设置
# MOST IMPORTANT, use basic magicMode, libfile kills performance
magicMode=basic
# pfring/snf might be better
pcapReadMethod=tpacketv3
# Increase by 1 if still getting Input Drops
tpacketv3NumThreads=2
# Defaults
pcapWriteMethod=simple
pcapWriteSize = 2560000
# Start with 5 packet threads, increase by 1 if getting thread drops
packetThreads=5
# Set to number of packets a second
maxPacketsInQueue = 200000

centos7 moloch安装及优化相关推荐

云计算基础课堂001 Linux系统与CentOS7的安装部署（小白向—怎么在VMware虚拟机安装基于Linux操作系统的CentOS7）
云计算基础课堂001 Linux系统与CentOS7的安装部署一.通过VMware部署CENTOS7系统软件创建虚拟机安装CentOS7 进入并登陆系统二.Linux历史与其发行版故事三. ...
Moloch安装与使用
0X01 moloch简介 Moloch是一款由 AOL 开源的,能够大规模的捕获IPv4数据包(PCAP).索引和数据库系统.所以我的Capture Machines和Elasticsearch M ...
centos7 Kubeadm安装配置K8S 及Dashboard外部服务
环境: Kubernetes Master节点:192.168.0.47 Kubernetes node1节点:192.168.0.33 Kubernetes node2节点:192.168.0.37 ...
CentOS7下安装lnmp一键安装包
上一篇说到CentOS7无法使用yum安装,把这个问题解决后,就开始安装环境lnmp一键安装包,建议新手还是选择lnmp一键安装包吧,至于为什么?大家都懂,省心省事省时间没毛病! 首先输入命令检查一下 ...
Centos7的配置与优化
Centos7的配置与优化文章目录 Centos7的配置与优化一.Liunx安装步骤 1.安装VM 2.安装Linux 二. 远程操作管理软件XShell 1. 为什么要远程操作Centos7呢? ...
Centos7.4安装Nginx
Centos7.4安装Nginx 使用yum命令一.安装准备首先由于nginx的一些模块依赖一些lib库,所以在安装nginx之前,必须先安装这些lib库,这些依赖库主要有g++.gcc.open ...
Centos7下安装Docker
Centos7下安装Docker(详细的新手装逼教程) 参考: https://www.cnblogs.com/qgc1995/archive/2018/08/29/9553572.html 早就听说 ...
mysql属性配置提高查询_MYSQL性能优化-安装时优化参数配置提高服务性能
MYSQL性能优化一直是个头痛的问题,目前大多都是直接把页面html静态页面或直接使用了缓存技术,下面我就mysql本身的性能优化来分享一下. 安装时优化参数配置提高服务性能在Linux下安装Mys ...
Centos7.4安装kvm虚拟机（使用virt-manager管理）
2019独角兽企业重金招聘Python工程师标准>>> Centos7.4安装kvm虚拟机(使用virt-manager管理) 之前介绍了使用WebVirtMgr或Openstack ...

centos7 moloch安装及优化

centos7 moloch安装及优化相关推荐

最新文章

热门文章