Linux Monitoring and Logging: Prometheus, Grafana, and ELK Stack

Effective Linux system management requires robust monitoring and an efficient logging system. This article covers tools and techniques for monitoring and logging using Prometheus, Grafana, and ELK Stack, providing detailed configuration examples.

Introduction to Monitoring and Logging in Linux

Monitoring and log collection are vital for maintaining the health and performance of Linux systems. They allow sysadmins and DevOps engineers to identify issues, optimize performance, and ensure compliance with security policies.

Prometheus: Metrics Collection

Prometheus is an open-source monitoring tool that collects system and application metrics. Its architecture is based on a push model, where data is sent to the Prometheus server.

Prometheus Installation

To install Prometheus on an Ubuntu system, run:

sudo apt update
sudo apt install prometheus

On CentOS systems, use:

sudo yum install prometheus

Basic Prometheus Configuration

Edit the configuration file prometheus.yml:

global:
scrape_interval: 15s

scrape_configs:
- job_name: 'prometheus'
  static_configs:
  - targets: ['localhost:9090']

Start Prometheus with the command:

prometheus --config.file=prometheus.yml

Grafana: Data Visualization

Grafana is an analytics and monitoring platform that allows creating interactive dashboards. It can be integrated with Prometheus to visualize collected metrics.

Grafana Installation

To install Grafana on Ubuntu, run:

sudo apt update
sudo apt install grafana

On CentOS, use:

sudo yum install grafana

Configuring Grafana with Prometheus

After starting Grafana (sudo systemctl start grafana-server), access http://localhost:3000. Add Prometheus as a data source in the Grafana settings.

ELK Stack: Log Collection and Analysis

The ELK Stack (Elasticsearch, Logstash, and Kibana) is a complete solution for log collection, processing, and visualization.

ELK Stack Installation

To install Elasticsearch, Logstash, and Kibana on Ubuntu, run:

sudo apt update
sudo apt install elasticsearch logstash kibana

On CentOS, use:

sudo yum install elasticsearch logstash kibana

Logstash Configuration

Create a configuration pipeline for Logstash (logstash.conf):

input {
  file {
    path => "/var/log/*.log"
    start_position => "beginning"
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

Start Logstash with the command:

sudo systemctl start logstash

Why This Matters / When to Use

The use of Prometheus, Grafana, and ELK Stack is crucial in production environments to ensure visibility and system integrity. They are especially useful in critical and high-availability applications, where real-time monitoring and log analysis are essential.

Connection with LPI/CompTIA Certifications

Mastering these tools is fundamental for professionals seeking certifications such as LPI and CompTIA, as it demonstrates a deep understanding of monitoring and log management in Linux environments, essential skills for sysadmins and DevOps engineers.