Added Splunk Docker capability, log access

This commit is contained in:
Marwolf
2018-07-20 01:16:29 -04:00
parent 2561e311bb
commit c6f2d26420
13 changed files with 103 additions and 0 deletions

9
.gitignore vendored
View File

@@ -18,3 +18,12 @@ data
etc/ssl/ etc/ssl/
get-docker\.sh get-docker\.sh
etc/nginx/logs/*
!etc/nginx/logs/empty
Splunk/opt-splunk-etc/*
!Splunk/opt-splunk-etc/empty
Splunk/opt-splunk-var/*
!Splunk/opt-splunk-var/empty

12
Splunk/Makefile Normal file
View File

@@ -0,0 +1,12 @@
start:
docker-compose up -d
stop:
@docker-compose down -v
restart:
@docker-compose down -v
docker-compose up -d
logs:
@docker-compose logs -f

View File

@@ -0,0 +1,3 @@
#!/bin/bash
sudo make start

View File

@@ -0,0 +1,5 @@
@echo off
echo:
make start
echo:

View File

@@ -0,0 +1,3 @@
#!/bin/bash
sudo make stop

View File

@@ -0,0 +1,5 @@
@echo off
echo:
make stop
echo:

View File

@@ -0,0 +1,3 @@
#!/bin/bash
sudo make logs

View File

@@ -0,0 +1,5 @@
@echo off
echo:
make logs
echo:

25
Splunk/docker-compose.yml Normal file
View File

@@ -0,0 +1,25 @@
version: '3'
volumes:
opt-splunk-etc:
opt-splunk-var:
services:
splunk:
hostname: splunk
image: splunk/splunk:latest
environment:
SPLUNK_START_ARGS: --accept-license --answer-yes --seed-passwd defaultpassword
OPTIMISTIC_ABOUT_FILE_LOCKING: '1'
SPLUNK_ENABLE_LISTEN: 9997
SPLUNK_ADD: tcp 1514
ports:
- "8000:8000" #Splunk Web interface
- "9997:9997" #Splunk receiving Port (not used by default) typically used by the Splunk Universal Forwarder
- "8088:8088" #HTTP Event Collector
- "1514:1514" #Network Input (not used by default) typically used to collect syslog TCP data
volumes:
- "../:/home/Docker-Home"
- "../etc/nginx/logs:/home/nginx-logs"
- "./opt-splunk-etc:/opt/splunk/etc"
- "./opt-splunk-var:/opt/splunk/var"

View File

View File

View File

@@ -7,6 +7,7 @@ services:
- "./etc/ssl:/etc/ssl" - "./etc/ssl:/etc/ssl"
- "./Website:/var/www/html/public" - "./Website:/var/www/html/public"
- "./etc/nginx/default.template.conf:/etc/nginx/conf.d/default.template" - "./etc/nginx/default.template.conf:/etc/nginx/conf.d/default.template"
- "./etc/nginx/logs:/var/log/nginx"
ports: ports:
- "80:80" - "80:80"
- "443:443" - "443:443"
@@ -14,6 +15,14 @@ services:
- NGINX_HOST=${NGINX_HOST} - NGINX_HOST=${NGINX_HOST}
command: /bin/sh -c "envsubst '$$NGINX_HOST' < /etc/nginx/conf.d/default.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'" command: /bin/sh -c "envsubst '$$NGINX_HOST' < /etc/nginx/conf.d/default.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"
restart: always restart: always
# logging:
# driver: splunk
# options:
# splunk-token: "e1c56fa1-9f7c-4d2c-ba8f-989b15d85008"
# splunk-url: "https://127.0.0.1:8088"
# splunk-insecureskipverify: "true"
# tag: "{{.ImageName}}/{{.Name}}/{{.ID}}"
# labels: "Nginx"
depends_on: depends_on:
- php - php
- mysqldb - mysqldb
@@ -23,6 +32,14 @@ services:
volumes: volumes:
- "./etc/php/php.ini:/usr/local/etc/php/conf.d/php.ini" - "./etc/php/php.ini:/usr/local/etc/php/conf.d/php.ini"
- "./Website:/var/www/html/public" - "./Website:/var/www/html/public"
# logging:
# driver: splunk
# options:
# splunk-token: "e1c56fa1-9f7c-4d2c-ba8f-989b15d85008"
# splunk-url: "https://127.0.0.1:8088"
# splunk-insecureskipverify: "true"
# tag: "{{.ImageName}}/{{.Name}}/{{.ID}}"
# labels: "PHP"
myadmin: myadmin:
image: phpmyadmin/phpmyadmin image: phpmyadmin/phpmyadmin
container_name: phpmyadmin container_name: phpmyadmin
@@ -34,6 +51,14 @@ services:
restart: always restart: always
depends_on: depends_on:
- mysqldb - mysqldb
# logging:
# driver: splunk
# options:
# splunk-token: "e1c56fa1-9f7c-4d2c-ba8f-989b15d85008"
# splunk-url: "https://127.0.0.1:8088"
# splunk-insecureskipverify: "true"
# tag: "{{.ImageName}}/{{.Name}}/{{.ID}}"
# labels: "PHPMyAdmin"
mysqldb: mysqldb:
image: mariadb:${MARIADB_VERSION} image: mariadb:${MARIADB_VERSION}
container_name: ${MYSQL_HOST} container_name: ${MYSQL_HOST}
@@ -50,3 +75,11 @@ services:
volumes: volumes:
- "./data/db/mysql:/var/lib/mysql" - "./data/db/mysql:/var/lib/mysql"
- "./etc/mariadb/innodb-fix.cnf:/etc/mysql/conf.d/innodb-fix.cnf" - "./etc/mariadb/innodb-fix.cnf:/etc/mysql/conf.d/innodb-fix.cnf"
# logging:
# driver: splunk
# options:
# splunk-token: "e1c56fa1-9f7c-4d2c-ba8f-989b15d85008"
# splunk-url: "https://127.0.0.1:8088"
# splunk-insecureskipverify: "true"
# tag: "{{.ImageName}}/{{.Name}}/{{.ID}}"
# labels: "MySQL"

0
etc/nginx/logs/empty Normal file
View File