https://souljian.cn/tags/%E5%AE%89%E5%85%A8%E7%9B%91%E6%8E%A7/Recent content in 安全监控 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088205/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088205/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>BPF 技术学习不涉及攻击。</p> <h2 id="一bpf-架构">一、BPF 架构 </h2><img src="https://souljian.cn/img/osi-layers.svg" alt="BPF 架构" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① BPF VM → ② 字节码加载 → ③ 系统调用挂钩 → ④ 数据收集 → ⑤ 性能分析 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二核心概念">二、核心概念 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">BPF VM：内核中的虚拟机，执行 BPF 字节码 </span></span><span class="line"><span class="cl">eBPF：扩展 BPF，支持更丰富的功能 </span></span><span class="line"><span class="cl">perf_events：性能事件收集 </span></span><span class="line"><span class="cl">tracepoints：内核追踪点 </span></span><span class="line"><span class="cl">kprobes/uprobes：内核/用户态探针 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三安全应用">三、安全应用 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">系统调用监控 · 网络流量分析 </span></span><span class="line"><span class="cl">文件操作追踪 · 进程行为监控 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>BPF 是 Linux 内核可编程的核心技术。eBPF 在安全监控和性能分析领域有广泛应用。</p>https://souljian.cn/p/751088206/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088206/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>本文讲监控系统搭建，不涉及攻击。</p> <h2 id="一监控架构">一、监控架构 </h2><img src="https://souljian.cn/img/osi-layers.svg" alt="监控架构" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① Exporter 采集 → ② Prometheus 存储 → ③ Alertmanager 告警 → ④ Grafana 展示 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二组件">二、组件 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Prometheus：时序数据库 · Pull 模式采集 </span></span><span class="line"><span class="cl">Grafana：可视化展示 </span></span><span class="line"><span class="cl">Alertmanager：告警管理 </span></span><span class="line"><span class="cl">Node Exporter：主机指标 </span></span><span class="line"><span class="cl">cAdvisor：容器指标 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三常用-promql">三、常用 PromQL </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">node_cpu_seconds_total · node_memory_MemAvailable_bytes </span></span><span class="line"><span class="cl">rate(node_network_receive_bytes_total[5m]) </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>Prometheus + Grafana 是现代监控的标准组合。掌握 PromQL 和 Dashboard 配置是运维安全的基本技能。</p>