Ubuntu Server 上部署与管理 Grafana 完整指南

sudo apt-get update
sudo apt-get upgrade -y
sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common

sudo useradd -r -s /bin/false grafana

sudo ufw allow 3000/tcp  # Grafana 默认端口
sudo ufw allow 22/tcp    # SSH 访问
sudo ufw enable

# 增加网络缓冲区大小
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
# 增加文件描述符限制
fs.file-max = 100000

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
sudo apt-get update
sudo apt-get install -y docker-ce

sudo systemctl enable docker
sudo systemctl start docker

sudo usermod -aG docker $USER
# 重新登录使更改生效

sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

docker pull grafana/grafana:latest

sudo mkdir -p /docker/grafana/{data,config,logs}
sudo chmod -R 777 /docker/grafana/data  # 确保容器有写入权限

docker run -d \
  --name=grafana \
  --restart=always \
  -p 3000:3000 \
  -v /docker/grafana/data:/var/lib/grafana \
  -v /docker/grafana/config:/etc/grafana \
  -v /docker/grafana/logs:/var/log/grafana \
  -e "GF_SECURITY_ADMIN_PASSWORD=mysecurepassword" \
  grafana/grafana:latest

version: '3.8'

services:
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=mysecurepassword
      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource
    volumes:
      - /docker/grafana/data:/var/lib/grafana
      - /docker/grafana/config:/etc/grafana
      - /docker/grafana/logs:/var/log/grafana
    networks:
      - grafana-net

networks:
  grafana-net:
    driver: bridge

docker-compose up -d

sudo apt-get install -y software-properties-common wget
wget -q -O - https://packages.grafana.com/gpg.key | sudo apt-key add -
echo "deb https://packages.grafana.com/oss/deb stable main" | sudo tee -a /etc/apt/sources.list.d/grafana.list

sudo apt-get update
sudo apt-get install grafana

sudo systemctl enable grafana-server
sudo systemctl start grafana-server
sudo systemctl status grafana-server  # 验证服务状态

[server]
# 配置访问域名或 IP
domain = your-domain.com
# 强制使用 HTTPS（生产环境推荐）
protocol = https
# 修改 HTTP 端口（可选）
http_port = 3000

[database]
# 配置外部数据库（默认使用内嵌 SQLite）
type = postgres
host = localhost:5432
name = grafana
user = grafana
password = yourpassword

[security]
# 加强安全设置
disable_gravatar = false
allow_embedding = false

[smtp]
# 配置邮件服务器（用于告警通知）
enabled = true
host = smtp.your-company.com:587
user = your-username
password = your-password

# 备份配置和数据
tar -czf grafana-backup-$(date +%Y%m%d).tar.gz /etc/grafana/grafana.ini /var/lib/grafana

# /etc/telegraf/telegraf.conf
[[outputs.influxdb]]
  urls = ["http://localhost:8086"]
  database = "telegraf"
  username = "telegraf"
  password = "telegraf"

[[inputs.cpu]]
  percpu = true
  totalcpu = true
  collect_cpu_time = false

[[inputs.disk]]
  ignore_fs = ["tmpfs", "devtmpfs", "devfs"]

# 变量配置
Name: host
Type: Query
Data source: Prometheus
Query: label_values(node_cpu_seconds_total, instance)

# CPU 使用率告警示例
Rule name: High CPU Usage
Evaluate every: 1m
For: 5m

Conditions:
- Query: A
- Reduce: max()
- Condition: IS ABOVE 80

# 高 CPU 且高内存使用率
Condition 1: 
  - Query A: CPU usage > 80%
Condition 2:
  - Query B: Memory usage > 90%
Operator: AND

Contact point type: Email
Addresses: team@company.com
Subject: [{{ .Status }}] {{ .GroupLabels.alertname }}

Contact point type: Slack
Webhook URL: https://hooks.slack.com/services/...
Message: 自定义告警消息模板

Contact point type: Webhook
URL: https://api.chatops.com/alert
HTTP Method: POST

Notification policy tree:
- Match: severity=critical
  Contact point: on-call-primary
  Group wait: 30s
- Match: severity=warning  
  Contact point: team-channel
  Group wait: 5m
- Default:
  Contact point: fallback

{{ define "custom.message" }}
Alert: {{ .GroupLabels.alertname }}
Instance: {{ .GroupLabels.instance }}
Summary: {{ .Annotations.summary }}
Description: {{ .Annotations.description }}
{{ end }}

/var/lib/grafana/plugins/
├── plugin1/
│   ├── README.md
│   ├── plugin.json
│   └── dist/
├── plugin2/
└── ...

# 安装特定插件
docker exec -it grafana grafana-cli plugins install <plugin-id>

# 安装指定版本
docker exec -it grafana grafana-cli plugins install <plugin-id> <version>

# 列出已安装插件
docker exec -it grafana grafana-cli plugins ls

environment:
  - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource

# 将插件文件复制到插件目录
sudo cp -r custom-plugin /var/lib/grafana/plugins/
# 重启 Grafana 服务
sudo systemctl restart grafana-server

# 安装 Grafana Toolkit
npm install -g @grafana/toolkit

# 创建新插件
npx @grafana/toolkit plugin:create my-plugin
cd my-plugin

# 开发模式运行
npm run dev

// 简单面板插件示例
export class MyPanel extends PureComponent<Props> {
  render() {
    const { data, width, height } = this.props;
    
    return (
      <div style={{ width, height }}>
        {/* 自定义渲染逻辑 */}
      </div>
    );
  }
}

# 访问指标端点
curl http://localhost:3000/metrics

# 示例指标
grafana_active_users 24
grafana_dashboard_views_total 1560
grafana_api_request_duration_seconds_bucket{handler="/api/dashboards/uid",le="0.5"} 134

healthcheck:
  test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
  interval: 30s
  timeout: 10s
  retries: 3

# grafana.ini 缓存配置
[database]
# 查询结果缓存
cache_mode = private

[dataproxy]
# 数据代理缓存
logging = true
timeout = 30
keep_alive_seconds = 300

[alerting]
# 告警查询缓存
evaluation_timeout_seconds = 30

[server]
# 并发连接限制
max_concurrent_connections = 100

[auth]
# 登录速率限制
login_maximum_inactive_lifetime_days = 7
login_maximum_lifetime_days = 30

[database]
type = postgres
host = localhost:5432
name = grafana
user = grafana
password = xxx
max_idle_conn = 10
max_open_conn = 100
conn_max_lifetime = 14400

#!/bin/bash
# grafana-backup.sh

BACKUP_DIR="/backup/grafana"
DATE=$(date +%Y%m%d)

# 备份配置文件
tar -czf $BACKUP_DIR/grafana-config-$DATE.tar.gz /etc/grafana/

# 备份数据目录（SQLite）
tar -czf $BACKUP_DIR/grafana-data-$DATE.tar.gz /var/lib/grafana/

# 备份插件（可选）
tar -czf $BACKUP_DIR/grafana-plugins-$DATE.tar.gz /var/lib/grafana/plugins/

# 保留最近 30 天备份
find $BACKUP_DIR -name "*.tar.gz" -mtime +30 -delete

#!/bin/bash
# dashboard-backup.sh

API_KEY="your-api-key"
GRAFANA_URL="http://localhost:3000"
BACKUP_DIR="/backup/dashboards"

# 获取所有仪表板
DASHBOARDS=$(curl -s -H "Authorization: Bearer $API_KEY" \
  "$GRAFANA_URL/api/search?type=dash-db" | jq -r '.[] | .uid')

# 导出每个仪表板
for UID in $DASHBOARDS; do
  curl -s -H "Authorization: Bearer $API_KEY" \
    "$GRAFANA_URL/api/dashboards/uid/$UID" | jq . > \
    "$BACKUP_DIR/dashboard-$UID-$(date +%Y%m%d).json"
done

                  +-----------------+
                  | Load Balancer   |
                  +-------+---------+
                          |
           +--------------+--------------+
           |                             |
+----------+----------+       +----------+----------+
|   Grafana Server A  |       |   Grafana Server B  |
| +------------------+|       | +------------------+|
| | Shared Database  ||       | | Shared Database  ||
| +------------------+|       | +------------------+|
+---------------------+       +---------------------+

[database]
type = postgres
host = ha-postgresql.local
name = grafana
user = grafana
password = xxx
ssl_mode = verify-full

[session]
provider = redis
provider_config = addr=redis-server:6379,password=xxx,db=0

[auth]
# 禁止用户自动注册
disable_signout_menu = false
# 登录令牌生命周期
login_maximum_inactive_lifetime_days = 7
login_maximum_lifetime_days = 30
# API 密钥过期时间
api_key_max_seconds_to_live = -1

[auth.ldap]
enabled = true
config_file = /etc/grafana/ldap.toml
sync_ttl = 60

# LDAP 服务器配置
[[servers]]
host = "ldap.company.com"
port = 636
use_ssl = true
bind_dn = "cn=admin,dc=company,dc=com"
bind_password = "password"

# 用户搜索配置
search_filter = "(cn=%s)"
search_base_dns = ["dc=company,dc=com"]

[auth.github]
enabled = true
client_id = your_client_id
client_secret = your_client_secret
scopes = user:email,read:org
allowed_organizations = company-org
team_ids = 123,456

[auth.saml]
enabled = true
certificate_path = /etc/grafana/saml.crt
private_key_path = /etc/grafana/saml.key
idp_metadata_url = https://sso.company.com/federationmetadata/2007-06/federationmetadata.xml

# 创建新组织
grafana-cli admin create-organization "TenantA"

# 添加用户到组织
grafana-cli admin users set-org --role Editor username "TenantA"

# 创建只读 API 密钥
curl -X POST -H "Content-Type: application/json" \
  -d '{"name":"monitoring-script","role":"Viewer"}' \
  http://admin:password@localhost:3000/api/auth/keys

[server]
protocol = https
http_port = 3000
domain = grafana.company.com
cert_file = /etc/grafana/ssl/grafana.crt
cert_key = /etc/grafana/ssl/grafana.key

# 强制 HTTPS 重定向
enforce_domain = true
root_url = https://grafana.company.com

[security]
# 安全相关 HTTP 头部
strict_transport_security = true
strict_transport_security_max_age_seconds = 31536000
strict_transport_security_preload = true
strict_transport_security_subdomains = true
x_content_type_options = true
x_xss_protection = true

[log]
mode = file
level = info
filters = security:debug

[audit]
enabled = true
logs = /var/log/grafana/audit.log

[security]
# GDPR 和相关合规支持
disable_gravatar = true
cookie_samesite = lax
allow_embedding = false

[users]
# 用户数据管理
allow_sign_up = false
auto_assign_org = false
auto_assign_org_role = Viewer

+-------------------+    +-----------------+    +---------------+
| Kubernetes Cluster|--->| Prometheus Stack|--->| Grafana       |
+-------------------+    +-----------------+    +---------------+
         |                         |                      |
   +------------+           +-------------+         +-----------+
   | Node       |           | Various     |         | Alerting |
   | Exporters  |           | Exporters   |         | & Display|
   +------------+           +-------------+         +-----------+

# prometheus.yml
global:
  scrape_interval: 30s
  scrape_timeout: 30s

scrape_configs:
  - job_name: 'kubernetes-nodes'
    kubernetes_sd_configs:
    - role: node
    relabel_configs:
    - source_labels: [__address__]
      regex: '(.*):10250'
      replacement: '${1}:9100'
      target_label: __address__
      action: replace

                      +-----------------+
                      | Central Grafana |
                      +-------+---------+
                              |
       +-----------------------+-----------------------+
       |                       |                       |
+--------------+        +--------------+        +--------------+
| DevOps Team  |        | Dev Team     |        | Ops Team     |
+--------------+        +--------------+        +--------------+
| - K8s监控    |        | - 应用性能   |        | - 基础设施   |
| - CI/CD流水线|        | - 业务指标   |        | - 网络监控   |
+--------------+        +--------------+        +--------------+

-- 业务指标查询示例（MySQL）
SELECT 
  DATE(created_at) as date,
  COUNT(*) as orders,
  SUM(total_amount) as revenue
FROM orders 
WHERE created_at >= NOW() - INTERVAL 7 DAY
GROUP BY DATE(created_at)
ORDER BY date DESC

# 机器学习任务配置
apiVersion: 1

machine_learning:
  - name: "CPU Usage Anomaly Detection"
    metric: "cpu_usage_percent"
    datasource: "prometheus"
    interval: "5m"
    sensitivity: 0.8

# 伪代码：业务异常检测
def detect_business_anomaly():
    current_orders = get_current_order_count()
    predicted_orders = get_predicted_order_count()
    deviation = (current_orders - predicted_orders) / predicted_orders
    
    if abs(deviation) > 0.3:  # 30% 偏差
        trigger_alert("业务量异常波动")