70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
---
|
|
- name: Deploy Loki using the local filesystem
|
|
hosts: all
|
|
become: true
|
|
roles:
|
|
- role: grafana.grafana.loki
|
|
vars:
|
|
loki_querier:
|
|
max_concurrent: 16
|
|
engine:
|
|
max_look_back_period: 8760h
|
|
loki_storage_config:
|
|
tsdb_shipper:
|
|
active_index_directory: "{{ loki_working_path }}/tsdb-index"
|
|
cache_location: "{{ loki_working_path }}/tsdb-cache"
|
|
filesystem:
|
|
directory: "{{ loki_working_path }}/chunks"
|
|
loki_ingester:
|
|
wal:
|
|
enabled: true
|
|
dir: "{{ loki_working_path }}/wal"
|
|
lifecycler:
|
|
address: 127.0.0.1
|
|
ring:
|
|
kvstore:
|
|
store: inmemory
|
|
replication_factor: 1
|
|
final_sleep: 0s
|
|
chunk_idle_period: 1h
|
|
max_chunk_age: 2h
|
|
chunk_target_size: 1048576
|
|
query_store_max_look_back_period: 8760h
|
|
loki_limits_config:
|
|
split_queries_by_interval: 0
|
|
reject_old_samples: true
|
|
reject_old_samples_max_age: 168h
|
|
max_query_length: 0
|
|
max_query_series: 50000
|
|
retention_period: 8760h
|
|
allow_structured_metadata: false
|
|
max_query_lookback: 8760h
|
|
loki_compactor:
|
|
working_directory: "{{ loki_working_path }}/compactor"
|
|
compaction_interval: 10m
|
|
retention_enabled: true
|
|
retention_delete_delay: 2h
|
|
retention_delete_worker_count: 150
|
|
delete_request_store: filesystem
|
|
loki_common:
|
|
path_prefix: "{{ loki_working_path }}"
|
|
storage:
|
|
filesystem:
|
|
rules_directory: "{{ loki_working_path }}/rules"
|
|
replication_factor: 1
|
|
ring:
|
|
instance_addr: 127.0.0.1
|
|
kvstore:
|
|
store: inmemory
|
|
loki_ruler_alerts:
|
|
- name: Logs.sshd
|
|
rules:
|
|
- alert: SshLoginFailed
|
|
expr: |
|
|
count_over_time({job=~"secure"} |="sshd[" |~": Failed|: Invalid|: Connection closed by authenticating user" | __error__="" [15m]) > 6
|
|
for: 0m
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "{% raw %}SSH authentication failure (instance {{ $labels.instance }}).{% endraw %}"
|
|
description: "{% raw %}Increase of SSH authentication failures in last 15 minutes\\n VALUE = {{ $value }}{% endraw %}"
|