GrafanaでSSH接続の監視をする（未解決）

 --------------------- SSHD Begin ------------------------


 Negotiation failed:
    no matching host key type found
       ***.***.***.***: 4 Times
         ecdsa-sha2-nistp384: 1 Time
         ecdsa-sha2-nistp521: 1 Time
         ssh-dss: 1 Time
         ssh-rsa: 1 Time
    no matching key exchange method found
       ***.***.***.***: 1 Time
         diffie-hellman-group1-sha1: 1 Time

 Illegal users from:
    ***.***.***.*** (***-***-***-***.ip.linodeusercontent.com): 1 Time
       xpybb: 1 Time

 **Unmatched Entries**
 error: Protocol major versions differ: 2 vs. 1 : 2 Times
 error: kex_exchange_identification: Connection closed by remote host : 2 Times
 error: kex_exchange_identification: banner line contains invalid characters : 2 Times

 ---------------------- SSHD End -------------------------

sudo apt install loki promtail

sudo systemctl status loki
● loki.service - Loki service
     Loaded: loaded (/etc/systemd/system/loki.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2023-12-04 11:20:18 JST; 15min ago
   Main PID: 33687 (loki)
      Tasks: 10 (limit: 9198)
     Memory: 52.7M
        CPU: 16.169s
     CGroup: /system.slice/loki.service
             └─33687 /usr/bin/loki -config.file /etc/loki/config.yml

sudo systemctl status promtail
● promtail.service - Promtail service
     Loaded: loaded (/etc/systemd/system/promtail.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2023-12-04 11:19:20 JST; 17min ago
   Main PID: 33305 (promtail)
      Tasks: 9 (limit: 9198)
     Memory: 28.4M
        CPU: 11.139s
     CGroup: /system.slice/promtail.service
             └─33305 /usr/bin/promtail -config.file /etc/promtail/config.yml

sudo ufw allow 3100
sudo ufw allow 9080
sudo ufw reload

sudo cat /etc/promtail/config.yml

sudo systemctl restart promtail
sudo systemctl status promtail
● promtail.service - Promtail service
     Loaded: loaded (/etc/systemd/system/promtail.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2023-12-04 18:51:53 JST; 15min ago
   Main PID: 49515 (promtail)
      Tasks: 9 (limit: 9198)
     Memory: 19.6M
        CPU: 11.433s
     CGroup: /system.slice/promtail.service
             └─49515 /usr/bin/promtail -config.file /etc/promtail/config.yml

Dec 04 19:07:08 ******** promtail[49515]: level=error ts=2023-12-04T10:07:08.207740098Z caller=filetarget.go:371 msg="failed to start tailer" error="open /var/log/mail.log: permission denied" filename=/var/log/ma>
Dec 04 19:07:08 ******** promtail[49515]: level=error ts=2023-12-04T10:07:08.207847835Z caller=filetarget.go:371 msg="failed to start tailer" error="open /var/log/syslog: permission denied" filename=/var/log/sysl>
Dec 04 19:07:08 ******** promtail[49515]: level=error ts=2023-12-04T10:07:08.207959553Z caller=filetarget.go:371 msg="failed to start tailer" error="open /var/log/ufw.log: permission denied" filename=/var/log/ufw>

sudo apt install acl

getfacl auth.log
# file: auth.log
# owner: syslog
# group: adm
user::rw-
group::r--
other::---

sudo setfacl -R -m u:promtail:rX /var/log

getfacl auth.log
# file: auth.log
# owner: syslog
# group: adm
user::rw-
user:promtail:r--
group::r--
mask::r--
other::---

A
Status: 500. Message: too many outstanding requests

sudo vi /etc/loki/config.yml

query_scheduler:
    max_outstanding_requests_per_tenant: 10000

sudo systemctl restart loki