服务器运维之日志审计

input {
  tcp {
    port => 5044
  }
}

output {
  elasticsearch { 
	hosts => ["localhost:9200"]
	user => "logstash_system"
	password => "rf08&ks" 
  }
  stdout { codec => rubydebug }
}

C:\Soft\logstash-8.2.0\bin>logstash -f logstash.conf
"Using bundled JDK: C:\Soft\logstash-8.2.0\jdk\bin\java.exe"
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in ve
rsion 9.0 and will likely be removed in a future release.
Sending Logstash logs to C:/Soft/logstash-8.2.0/logs which is now configured via
 log4j2.properties
[2022-05-22T09:50:09,155][INFO ][logstash.runner          ] Log4j configuration
path used is: C:\Soft\logstash-8.2.0\config\log4j2.properties
[2022-05-22T09:50:09,171][WARN ][logstash.runner          ] The use of JAVA_HOME
 has been deprecated. Logstash 8.0 and later ignores JAVA_HOME and uses the bund
led JDK. Running Logstash with the bundled JDK is recommended. The bundled JDK h
as been verified to work with each specific version of Logstash, and generally p
rovides best performance and reliability. If you have compelling reasons for usi
ng your own JDK (organizational-specific compliance requirements, for example),
you can configure LS_JAVA_HOME to use that version instead.
[2022-05-22T09:50:09,171][INFO ][logstash.runner          ] Starting Logstash {"
logstash.version"=>"8.2.0", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30
2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.14.1+1 on 11.0.14.1+1 +indy +jit [mswin
32-x86_64]"}
[2022-05-22T09:50:09,186][INFO ][logstash.runner          ] JVM bootstrap flags:
 [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75
, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=
UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -XX:+HeapDum
pOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadCon
textMapInheritable=true, -Djruby.regexp.interruptible=true, --add-opens=java.bas
e/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-op
ens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=AL
L-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[2022-05-22T09:50:09,233][INFO ][logstash.settings        ] Creating directory {
:setting=>"path.queue", :path=>"C:/Soft/logstash-8.2.0/data/queue"}
[2022-05-22T09:50:09,249][INFO ][logstash.settings        ] Creating directory {
:setting=>"path.dead_letter_queue", :path=>"C:/Soft/logstash-8.2.0/data/dead_let
ter_queue"}
[2022-05-22T09:50:09,342][WARN ][logstash.config.source.multilocal] Ignoring the
 'pipelines.yml' file because modules or command line options are specified
[2022-05-22T09:50:09,405][INFO ][logstash.agent           ] No persistent UUID f
ile found. Generating new UUID {:uuid=>"ea8fe73b-25e1-410a-a4f4-39d9f4a03f6e", :
path=>"C:/Soft/logstash-8.2.0/data/uuid"}
TimerTask timeouts are now ignored as these were not able to be implemented corr
ectly
TimerTask timeouts are now ignored as these were not able to be implemented corr
ectly
TimerTask timeouts are now ignored as these were not able to be implemented corr
ectly
TimerTask timeouts are now ignored as these were not able to be implemented corr
ectly
[2022-05-22T09:50:14,743][INFO ][logstash.config.source.local.configpathloader]
No config files found in path {:path=>"C:/Soft/logstash-8.2.0/logstash.conf"}
[2022-05-22T09:50:14,776][ERROR][logstash.config.sourceloader] No configuration
found in the configured sources.
[2022-05-22T09:50:14,885][INFO ][logstash.agent           ] Successfully started
 Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2022-05-22T09:50:20,339][INFO ][logstash.runner          ] Logstash shut down.
[2022-05-22T09:50:20,354][FATAL][org.logstash.Logstash    ] Logstash stopped pro
cessing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby.jar:
?]
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby.jar:
?]
        at C_3a_.Soft.logstash_minus_8_dot_2_dot_0.lib.bootstrap.environment.<ma
in>(C:\Soft\logstash-8.2.0\lib\bootstrap\environment.rb:91) ~[?:?]

C:\Soft\logstash-8.2.0\bin>

C:\Soft\kibana-8.2.0\bin>kibana.bat
Node.js is only supported on Windows 8.1, Windows Server 2012 R2, or higher.
Setting the NODE_SKIP_PLATFORM_CHECK environment variable to 1 skips this
check, but Node.js might not execute correctly. Any issues encountered on
unsupported platforms will not be fixed.
C:\Soft\kibana-8.2.0\bin>

C:\Soft\kibana-8.2.0\bin>kibana.bat
node:os:68
      throw new ERR_SYSTEM_ERROR(ctx);
      ^

SystemError [ERR_SYSTEM_ERROR]: A system error occurred: uv_os_gethostname retur
ned ENOSYS (function not implemented)
    at Object.<anonymous> (C:\Soft\kibana-8.2.0\node_modules\elastic-apm-http-cl
ient\index.js:39:21)
    at Module._compile (node:internal/modules/cjs/loader:1103:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1157:10)
    at Module.load (node:internal/modules/cjs/loader:981:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12)
    at Module.require (node:internal/modules/cjs/loader:1005:19)
    at require (node:internal/modules/cjs/helpers:102:18)
    at Object.<anonymous> (C:\Soft\kibana-8.2.0\node_modules\elastic-apm-node\li
b\config.js:6:28)
    at Module._compile (node:internal/modules/cjs/loader:1103:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1157:10)
{
  code: 'ERR_SYSTEM_ERROR',
  info: {
    errno: -4054,
    code: 'ENOSYS',
    message: 'function not implemented',
    syscall: 'uv_os_gethostname'
  },
  errno: [Getter/Setter],
  syscall: [Getter/Setter]
}

C:\Soft\kibana-8.2.0\bin>

.\winlogbeat.exe -c .\winlogbeat.yml -configtest -e