大型IT架構中系統日誌資訊蒐集與呈現

交通大學資工系資訊中心服務日益增長，不能再單純以syslog進行日誌的收集，也不該單以Logwatch進行系統日誌分析來評斷系統是否穩定。資訊中心在2018年利用重新設計日誌儲存系統的契機導入rsyslog，也於同年導入Nagios進行系統監控。但是資訊中心仍對日誌分析與資料呈現掌握度不足感到焦慮，為了提升查閱日誌的便利性，以及呈現錯誤資訊與系統狀態，將接續李樸（2018）的ELK系統，並通過強化ELK原有功能與擴張收集日誌之範圍。此篇論文中將從協助Linux系統、電子郵件與帳號管理系統進行日誌資料收集開始，透過整理日誌資料的契機同時完成資料分析與資料呈現，最後將錯誤的資料進行通報，讓管理人員第一時間得到系統資訊。最後期待此套系統可以大幅提升資訊中心對於各套系統服務狀態的掌握程度外，並以此為範例加強與各組的合作關係，納入各組系統，提高資訊中心管理人員對於日誌資料呈現與監控意願。

關鍵字

日誌蒐集；日誌分析；日誌資料呈現

並列摘要

Due to the fact that more and more services are provided from NCTU CS center recently, we can neither rely on “syslog” to collect the system log nor leverage “Logwatch” to determine the system whether it is stable or not. With the chance of re-designing the storage system of log, the CS center introduced “rsyslog” as well as “Nagios” to monitor the system in 2018. Despite of that, the CS center still feel anxious about lack of comprehension of logging analysis and data visualization. In order to improve the convenience of looking up logging and visualize the error information and the system status. We continue the work from ELK system [Lee 2018], and reinforce the original feature and expand the range of collecting log. In this paper, we will start from the assistance of collecting log from Linux system, email and the account management system and finish the data analysis and data visualization at the same time. At last, we will also report the error message to administrator at the first time once error happened. With this proposed system, we hope that it can greatly improve the level of understanding of different systems and services. Likewise, being used as an example to make strong the binding between different groups as well as to increase the administrator’s willingness to visualize logging and monitoring after supporting with individual systems.