Filebeat on OpenBSD 6.0

In an effort to improve monitoring, I setup an ELK (Elasticsearch, Logstash, Kibana) server and setup my different servers to forward their logs. Filebeat is typically installed on the servers to do the forwarding and normally this installation is pretty straight forward.

However, Filebeat is dependent on Go 1.7 and OpenBSD 6.0 only provides 1.6 as a binary package.

The following steps will setup an OpenBSD ports build machine, update the ports to current, build the required packages; then copy the packages to the target OpenBSD server, install the packages, install and configure Filebeat.

Setup OpenBSD Ports Build Machine

Building from the ports system isn’t hard, but the partition layout and not wanting to have the ports tree on a production server resulted in my decision to create a VM just to build ports.

The default partition layout that the OpenBSD 6.0 installer wants to use does not provide enough disk space to build Go and it’s dependencies.

During the install, when prompted to partition the drive, I removed all partitions except swap and then added all the space back as root ‘/’.

Note, this is not a recommended partition strategy and is not something that should be run as a production server, but as a short lived build server, it is a reasonable shortcut.

After installation, I installed sudo (like an animal) and configured the /etc/sudoers file to allow the wheel group to sudo:

The final step in setting up the ports build machine is to update:

Fetching Ports Tree

With an updated ports build machine, fetch the ports tree and update it from CVS.

Fetch the ports.tar.gz from the nearest mirror or ftp.openbsd.org:

Validate the download:

You are looking for a response like:

Next, uncompress the archive to /usr:

Updating From CVS

This next step is potentially dangerous to the stability of your system. In fact, the binary packages created may not work on OpenBSD 6.0 and I may just have gotten lucky building a working Go 1.7 that works on OpenBSD 6.0.

We are building Go 1.7 from current to install on a stable system.

If that hasn’t scared you off, please read https://www.openbsd.org/faq/faq5.html to understand the release, stable and current flavors.

Looking at the commits for Go 1.7, we want to update the ports tree to current:

If the update is successful, build Go and it’s dependencies.

At this point it might be worthwhile installing screen so that if the compile takes long, you can disconnect from the terminal:

Finally, build:

Once complete the binary package files should be in:

Copy all the binary package files to the target OpenBSD server and move them to /usr/ports/packages/amd64/all.

On the target OpenBSD server, install the binary packages:

The ports build machine can now be shutdown.

Install Filebeat

On the target OpenBSD server, install a few dependencies:

Set up the Go build environment and get the Filebeat source:

Switch to the 5.0 release branch:

Build Filebeat:

Install Filebeat and set permissions:

Copy Filebeat config files:

Create Filebeat rc file:

Set permissions:

Reference for the rc file:

http://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/sysutils/beats/filebeat/pkg/filebeat.rc?rev=1.1.1.1&content-type=text/plain

Add a reference to the rc file to rc.conf.local so that it starts up on boot:

Configure Filebeat

Filebeat can be configured to log to Elasticsearch or Logstash. Logstash is probably the better option, especially when using TLS/LSS.

Below is an example filebeat.yml, please note that this will need to be customized to include what you want to forward:

For details on setting up TLS/SSL please see:

https://www.elastic.co/guide/en/beats/filebeat/5.0/configuring-ssl-logstash.html

Manage Filebeat

Use rc script to manage:

Filebeat logs to:

Conclusion

Thats it, hope that you have found this useful, when OpenBSD 6.1 comes out it will likely include Go 1.7 so these instructions will likely not be necessary.

Comments are closed.