1
1)下载软件包
2
'官方社区版，Apache 2.0 许可'
3
jiuzhao@Ubuntu 下载$ wget -P /home/jiuzhao/下载 https://github.com/VictoriaMetrics/VictoriaMetrics/releases/download/v1.150.0/victoria-metrics-linux-amd64-v1.150.0.tar.gz
4
jiuzhao@Ubuntu 下载$ scp /home/jiuzhao/下载/victoria-metrics-linux-amd64-v1.150.0.tar.gz node3:/tmp
5
# 拷贝到 /tmp 目录
6

7
2)解压二进制到 /usr/local/bin/
8
[root@node3 ~]# tar tf /tmp/victoria-metrics-linux-amd64-v1.150.0.tar.gz
9
victoria-metrics-prod
10
[root@node3 ~]# tar xf /tmp/victoria-metrics-linux-amd64-v1.150.0.tar.gz -C /usr/local/bin/
11
[root@node3 ~]# ls /usr/local/bin/victoria-metrics-prod
12
/usr/local/bin/victoria-metrics-prod
13
# 直接解压出单个二进制，不需要额外依赖
14

15
3)创建数据目录
16
[root@node3 ~]# mkdir -p /var/lib/victoria-metrics
17

18
4)创建 systemd 服务文件
19
[root@node3 ~]# cat > /etc/systemd/system/victoria-metrics.service <<'EOF'
20
[Unit]
21
Description=VictoriaMetrics Server
22
Documentation=https://docs.victoriametrics.com/
23
# 等待网络就绪后再启动
24
After=network-online.target
25
# 主动声明依赖网络在线目标
26
Wants=network-online.target
27

28
[Service]
29
# 前台常驻进程：拉起即算成功
30
Type=simple
31
# 异常退出时自动重启
32
Restart=on-failure
33
# 重启间隔 3 秒
34
RestartSec=3
35
# 文件描述符上限
36
LimitNOFILE=65536
37
ExecStart=/usr/local/bin/victoria-metrics-prod \
38
   -httpListenAddr=0.0.0.0:8428 \
39
   -storageDataPath=/var/lib/victoria-metrics \
40
   -retentionPeriod=3
41
# -httpListenAddr: 监听地址和端口
42
# -storageDataPath: 数据存储路径
43
# -retentionPeriod=3: 数据保留3个月
44

45
[Install]
46
WantedBy=multi-user.target
47
EOF
48

49
5)启动并设置开机自启
50
[root@node3 ~]# systemctl daemon-reload
51
[root@node3 ~]# systemctl enable --now victoria-metrics.service
52
[root@node3 ~]# systemctl status victoria-metrics.service
53
● victoria-metrics.service - VictoriaMetrics Server
54
     Loaded: loaded (/etc/systemd/system/victoria-metrics.service; enabled; ...)
55
     Active: active (running) since ...
56
   Main PID: 12345 (victoria-metrics)
57
✅️ 状态 active (running)，启动成功
58

59
6)验证端口
60
[root@node3 ~]# ss -ntl | grep 8428
61
LISTEN 0      4096         0.0.0.0:8428      0.0.0.0:*
62
# 8428 端口正常监听 ✅️
63

64
7)验证 WebUI
65
http://10.0.0.12:8428/
66
# VictoriaMetrics 自带简洁的 Web 界面

1
1)修改 prometheus.yml，添加 remote_write
2
root@Prom ~# vim /etc/prometheus/prometheus.yml
3
...
4
# 在顶级字段中添加 remote_write（与 scrape_configs 同级）
5
remote_write:
6
  - url: http://10.0.0.12:8428/api/v1/write
7
# remote_write 使用 VM 的 write 接口
8
root@Prom ~# egrep -v '^[[:space:]]*$|^[[:space:]]*#' /etc/prometheus/prometheus.yml
9
global:
10
  scrape_interval: 15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
11
  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
12
alerting:
13
  alertmanagers:
14
    - static_configs:
15
        - targets:
16
rule_files:
17
scrape_configs:
18
  - job_name: "prometheus"
19
    static_configs:
20
      - targets: ["localhost:9090"]
21
        labels:
22
          app: "prometheus"
23
  - job_name: "kpyun-node-exporter"          # job 名称自定义
24
    metrics_path: "/metrics"                 # 被监控路径
25
    scheme: "http"                           # 协议
26
    static_configs:
27
      - targets: ["10.0.0.2:9100","10.0.0.11:9100","10.0.0.12:9100"]  # 后端地址
28
remote_write:
29
  - url: http://10.0.0.12:8428/api/v1/write
30

31
2)检查配置文件语法
32
root@Prom ~# promtool check config /etc/prometheus/prometheus.yml
33
Checking /etc/prometheus/prometheus.yml
34
 SUCCESS: /etc/prometheus/prometheus.yml is valid prometheus config file syntax
35

36
3)重启 Prometheus
37
root@Prom ~# systemctl restart prometheus
38
# remote_write 是顶级字段，需要重启才能生效
39

40
4)验证 Prometheus 日志，确认 remote_write 已连接
41
root@Prom ~# tail -f /var/log/prometheus/prometheus.log
42
"msg":"Done replaying WAL","component":"remote","url":"http://10.0.0.12:8428/api/v1/write"
43
✅ remote_watcher 已完成 WAL 重放（启动完成）
44
✅ 目标地址：http://10.0.0.12:8428/api/v1/write（VictoriaMetrics）

1
1)创建证书工作区
2
root@Prom ~# mkdir -p /etc/prometheus/certs
3
root@Prom ~# cd /etc/prometheus/certs
4
root@Prom certs# mkdir private certs
5
# private: 存放 Root CA、Intermediate CA 和服务器私钥
6
# certs: 存放各种证书和证书链
7
root@Prom certs# chmod 700 private
8
# 私钥目录只允许 root 访问
9

10
2)生成 Root CA 私钥
11
root@Prom certs# openssl genrsa -out private/rootCA.key 4096
12
# 4096 位 RSA 根私钥
13

14
3)生成 Root CA 自签名证书
15
root@Prom certs# openssl req -x509 -new -nodes \
16
  -key private/rootCA.key \
17
  -sha256 \
18
  -days 3650 \
19
  -out certs/rootCA.crt \
20
  -subj "/C=CN/ST=Beijing/L=Beijing/O=kpyun/CN=kpyun-RootCA"
21
# rootCA.crt 是后续导入客户端信任库的根证书
22
✅️ Root CA 生成完成

1
1)生成 Intermediate CA 私钥
2
root@Prom certs# openssl genrsa -out private/intermediate.key 4096
3
# 4096 位 RSA Intermediate CA 私钥
4

5
2)生成 Intermediate CA 的 CSR
6
root@Prom certs# openssl req -new \
7
  -key private/intermediate.key \
8
  -out intermediate.csr \
9
  -subj "/C=CN/ST=Beijing/L=Beijing/O=kpyun/CN=kpyun-IntermediateCA"
10

11
3)Root CA 签发 Intermediate CA
12
root@Prom certs# openssl x509 -req \
13
  -in intermediate.csr \
14
  -CA certs/rootCA.crt \
15
  -CAkey private/rootCA.key \
16
  -CAcreateserial \
17
  -out certs/intermediate.crt \
18
  -days 1825 \
19
  -sha256 \
20
  -extfile <(printf "basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign")
21
# pathlen:0 表示不允许继续签发下一级 Intermediate CA
22

23
4)验证 Intermediate CA
24
root@Prom certs# openssl x509 -in certs/intermediate.crt -noout -subject -issuer
25
subject=C=CN, ST=Beijing, L=Beijing, O=kpyun, CN=kpyun-IntermediateCA
26
issuer=C=CN, ST=Beijing, L=Beijing, O=kpyun, CN=kpyun-RootCA
27
✅️ Intermediate CA 已由 Root CA 签发

1
1)生成 Prometheus 服务器私钥
2
root@Prom certs# openssl genrsa -out private/prometheus.kpyun.com.key 4096
3
# 4096 位 RSA 服务器私钥
4

5
2)生成 Prometheus 服务器 CSR
6
root@Prom certs# openssl req -new \
7
  -key private/prometheus.kpyun.com.key \
8
  -out prometheus.kpyun.com.csr \
9
  -subj "/C=CN/ST=Beijing/L=Beijing/O=kpyun/OU=Prometheus/CN=prometheus.kpyun.com"
10
# 先生成服务器私钥和 CSR,再准备证书扩展信息
11

12
3)创建服务器证书扩展文件
13
root@Prom certs# cat > prometheus-server.ext <<'EOF'
14
authorityKeyIdentifier=keyid,issuer
15
basicConstraints=CA:FALSE
16
keyUsage=critical,digitalSignature,keyEncipherment
17
extendedKeyUsage=serverAuth
18
subjectAltName=@alt_names
19

20
[alt_names]
21
DNS.1=kpyun.com
22
DNS.2=prometheus.kpyun.com
23
DNS.3=localhost
24
IP.1=10.0.0.10
25
IP.2=127.0.0.1
26
EOF
27
# SAN 中写入所有实际访问 Prometheus 的域名和 IP
28

29
4)Intermediate CA 签发 Prometheus 服务器证书
30
root@Prom certs# openssl x509 -req \
31
  -in prometheus.kpyun.com.csr \
32
  -CA certs/intermediate.crt \
33
  -CAkey private/intermediate.key \
34
  -CAcreateserial \
35
  -out certs/prometheus.kpyun.com.crt \
36
  -days 365 \
37
  -sha256 \
38
  -extfile prometheus-server.ext
39
# 这里用 Intermediate CA 签发,不是 Root CA 直接签发
40

41
5)合并完整证书链
42
root@Prom certs# cat certs/prometheus.kpyun.com.crt certs/intermediate.crt > certs/fullchain.crt
43
# fullchain.crt = Prometheus 服务器证书 + Intermediate CA 证书
44

45
6)验证完整证书链
46
root@Prom certs# openssl verify \
47
  -CAfile certs/rootCA.crt \
48
  -untrusted certs/intermediate.crt \
49
  certs/prometheus.kpyun.com.crt
50
certs/prometheus.kpyun.com.crt: OK
51
✅️ Root CA → Intermediate CA → Prometheus Server Certificate 验证通过
52

53
7)查看最终目录
54
root@Prom certs# tree .
55
.
56
├── certs
57
│   ├── fullchain.crt
58
│   ├── intermediate.crt
59
│   ├── intermediate.srl
60
│   ├── prometheus.kpyun.com.crt
61
│   └── rootCA.crt
62
├── intermediate.csr
63
├── private
64
│   ├── intermediate.key
65
│   ├── prometheus.kpyun.com.key
66
│   └── rootCA.key
67
├── prometheus-server.ext
68
├── prometheus.kpyun.com.csr
69
└── rootCA.srl

1
1)生成 Basic Auth 用户密码
2
'使用 htpasswd 工具生成 bcrypt 哈希'
3
root@Prom ~# apt-get -y install apache2-utils
4
root@Prom ~# htpasswd -Bbc /tmp/auth kpyun kpyun123
5
-B      # 强制使用 bcrypt 加密算法（当前推荐，安全性高）
6
-b      # 在命令行中直接提供密码（注意：此方式会暴露密码，生产环境慎用）
7
-c      # 创建新文件（若文件已存在则覆盖）
8
Adding password for user kpyun
9
root@Prom ~# cat /tmp/auth
10
kpyun:$2y$05$F99Z4rJKrgrmKaJZt1pVi.NbfEo2KEInl0CCmRjy6RPFfM.kL.dmW
11
# 用户名: kpyun，密码: kpyun123
12
===================================
13
`无需按装，直接生成（系统有 Python 3 和 bcrypt 库）`
14
root@Prom ~# python3 -c 'import bcrypt; pwd="kpyun123"; print("kpyun: " + bcrypt.hashpw(pwd.encode(), bcrypt.gensalt(rounds=10)).decode())'
15
kpyun: $2b$10$yLoDjSLYj5oLa64ptcv9JuFfCAGeKjHIyJGUM7G10Ob4glXn1ZiP2
16

17

18
2)创建 Prometheus 认证配置文件
19
root@Prom ~# cat > /etc/prometheus/auth.yml <<'EOF'
20
tls_server_config:
21
  cert_file: /etc/prometheus/certs/certs/fullchain.crt
22
  key_file: /etc/prometheus/certs/private/prometheus.kpyun.com.key
23

24
basic_auth_users:
25
  kpyun: $2y$05$F99Z4rJKrgrmKaJZt1pVi.NbfEo2KEInl0CCmRjy6RPFfM.kL.dmW
26
EOF
27
# cert_file: 使用 fullchain.crt（包含中间证书链）
28
# key_file: private/ 下的 Prometheus 服务端私钥
29
# ⚠️ 密码哈希要从 htpasswd 输出中复制完整

1
1)修改 Prometheus 的 systemd 服务，添加 --web.config.file 参数
2
root@Prom ~# vim /etc/systemd/system/prometheus.service
3
....
4
  --web.config.file=/etc/prometheus/auth.yml \
5
# --web.config.file: 指定认证配置文件路径
6
# ✅ 重点就加了这一行
7

8
2)重启 Prometheus
9
root@Prom ~# systemctl daemon-reload
10
root@Prom ~# systemctl restart prometheus
11
root@Prom ~# ss -ntl | grep 9090
12
LISTEN 0      4096               *:9090            *:*
13
# 端口正常监听
14

15
3)浏览器访问
16
# 打开 https://10.0.0.10:9090
17
# 浏览器会提示"不安全"（自签名证书），点击"继续访问"
18
# 弹出认证框，输入用户名: kpyun，密码: kpyun123
19
✅️ 登录成功，看到 Prometheus WebUI
20

21
4)命令行验证
22
root@Prom ~# curl -k -u kpyun:kpyun123 https://10.0.0.10:9090/-/healthy
23
Prometheus Server is Healthy.
24
✅️ HTTPS + Basic Auth 均正常
25

26
5)不带认证测试（应被拒绝）
27
root@Prom ~# curl -k https://10.0.0.10:9090/-/healthy
28
401 Unauthorized
29
✅️ 未认证访问被正确拦截
30

31
https://10.0.0.10:9090/targets?search=prometheus

1
1)修改 prometheus.yml 中 prometheus job
2
root@Prom ~# vim /etc/prometheus/prometheus.yml
3
...
4
  - job_name: "prometheus"
5
    scheme: 'https'
6
    tls_config:
7
      insecure_skip_verify: true
8
      # 自签名证书，跳过校验
9
    basic_auth:
10
      username: kpyun
11
      password: kpyun123
12
    static_configs:
13
      - targets: ["10.0.0.10:9090"]
14
# scheme: https → 使用 HTTPS 协议
15
# insecure_skip_verify: true → 不校验证书（自签名场景）
16

17
2)热加载配置
18
root@Prom ~# curl -k -u kpyun:kpyun123 -X POST https://10.0.0.10:9090/-/reload
19
# -k: 跳过证书校验
20
# -u: Basic Auth 认证
21

22
3)验证抓取状态
23
# 浏览器访问 https://10.0.0.10:9090/targets?search=prometheus
24
# Prometheus job 的 target 状态应为 UP ✅️

1
1)拷贝到宿主机
2
jiuzhao@Ubuntu 下载$ scp Prom:/etc/prometheus/certs/certs/rootCA.crt .
3

4
2)修改宿主机 hosts表
5
jiuzhao@Ubuntu ~$ sudo vim /etc/hosts
6
10.0.0.10   prometheus.kpyun.com  kpyun.com
7
`两个域名都可以进行访问`
8

9
3)CA证书导入浏览器
10
edge://certificate-manager/localcerts/usercerts
11
# 在“受信任的证书”栏目下，点击 “导入” （刚才拷贝的 rootCA.crt 文件）
12

13
4)测试访问
14
https://prometheus.kpyun.com:9090
15
# 地址栏应显示安全锁标志，不再提示“您的连接不是私密连接”

1
1)未导入系统证书
2
root@Prom ~# curl -u kpyun:kpyun123 https://10.0.0.10:9090/-/healthy
3
curl: (60) SSL certificate problem: unable to get local issuer certificate
4
`SSL证书问题：无法获取本地颁发者证书`
5
# 需要 -k 跳过 SSL 校验
6

7
2)根证书导入 Linux 系统信任库
8
# 复制根证书到系统证书目录
9
root@Prom ~# sudo cp /etc/prometheus/certs/certs/rootCA.crt /usr/local/share/ca-certificates/
10

11
# 更新系统证书库
12
root@Prom ~# sudo update-ca-certificates
13

14
3)不再需要 -k（跳过校验）SSL 校验通过
15
root@Prom ~# curl -u kpyun:kpyun123 https://10.0.0.10:9090/-/healthy
16
Prometheus Server is Healthy.

1
1)停止 node-exporter 服务
2
[root@node1 ~]# systemctl stop node-exporter
3

4
2)【黑名单】禁用指定 collector
5
[root@node1 ~]# node_exporter --version | head -1
6
node_exporter, version 1.12.1
7
[root@node1 ~]# node_exporter \
8
  --no-collector.cpu \
9
  --no-collector.meminfo \
10
  --no-collector.loadavg
11
# --no-collector.cpu: 不采集 CPU 指标
12
# --no-collector.meminfo: 不采集内存信息
13
# --no-collector.loadavg: 不采集负载信息
14

15
root@Prom ~# curl -s 10.0.0.2:9100/metrics | grep -c node_cpu_*
16
0
17
# 访问 http://10.0.0.2:9100/metrics 验证
18
# node_cpu_* 指标: 🈚 不存在
19
# node_memory_* 指标: 🈚 不存在
20
# node_load* 指标: 🈚 不存在
21
✅️ 黑名单生效，指定指标已隐藏
22

23
3)【白名单】只启用指定 collector
24
[root@node1 ~]# node_exporter \
25
  --collector.disable-defaults \
26
  --collector.cpu \
27
  --collector.uname \
28
  --collector.diskstats
29
# --collector.disable-defaults: 先禁用所有 collector
30
# --collector.cpu: 只启用 CPU collector
31
# --collector.uname: 只启用系统信息 collector
32
# --collector.diskstats: 只启用磁盘统计 collector
33

34
root@Prom ~# curl -s 10.0.0.2:9100/metrics | grep -c node_disk_*
35
98
36
# 访问 http://10.0.0.2:9100/metrics 验证
37
# 指标数量大幅减少，只保留 cpu/uname/diskstats 相关
38
# node_cpu_seconds_total: ✅️ 存在
39
# node_uname_info: ✅️ 存在
40
# node_disk_*: ✅️ 存在
41
root@Prom ~# curl -s 10.0.0.2:9100/metrics | grep -c node_memory_*
42
0
43
# node_memory_*: 🈚 不存在
44
# node_load*: 🈚 不存在
45
✅️ 白名单生效，只暴露指定指标
46

47
4)恢复默认配置并重启服务
48
[root@node1 ~]# systemctl start node-exporter
49
# 测试完毕恢复原状

1
1)【黑名单】排除指定 collector
2
root@Prom ~# vim /etc/prometheus/prometheus.yml
3
...
4
  - job_name: "kpyun-blacklist"
5
    params:
6
      exclude[]:
7
        - cpu
8
        - meminfo
9
    static_configs:
10
      - targets: ["10.0.0.2:9100"]
11
# exclude[]: 排除 cpu 和 meminfo collector
12

13

14
2)检查配置并热加载
15
root@Prom ~# promtool check config /etc/prometheus/prometheus.yml
16
Checking /etc/prometheus/prometheus.yml
17
 SUCCESS: /etc/prometheus/prometheus.yml is valid prometheus config file syntax
18
root@Prom ~# curl -k -u kpyun:kpyun123 -X POST https://10.0.0.10:9090/-/reload
19

20
3)验证黑名单
21
# Prometheus WebUI 查询:
22
node_cpu_seconds_total{job="kpyun-blacklist",instance="10.0.0.2:9100"}
23
# 🈚 无数据（被 exclude 排除了）
24
node_uname_info{job="kpyun-blacklist",instance="10.0.0.2:9100"}
25
# ✅️ 有数据（uname 未被排除）
26
✅️ 服务端黑名单生效
27

28
4)【白名单】只采集指定 collector
29
root@Prom ~# vim /etc/prometheus/prometheus.yml
30
...
31
  - job_name: "kpyun-whitelist"
32
    params:
33
      collect[]:
34
        - uname
35
        - diskstats
36
    static_configs:
37
      - targets: ["10.0.0.2:9100"]
38
# collect[]: 只采集 uname 和 diskstats
39

40
5)检查配置并热加载
41
root@Prom ~# promtool check config /etc/prometheus/prometheus.yml
42
root@Prom ~# curl -k -u kpyun:kpyun123 -X POST https://10.0.0.10:9090/-/reload
43

44
6)验证白名单
45
# Prometheus WebUI 查询:
46
node_uname_info{job="kpyun-whitelist",instance="10.0.0.2:9100"}
47
# ✅️ 有数据
48
node_disk_io_now{job="kpyun-whitelist",instance="10.0.0.2:9100"}
49
# ✅️ 有数据
50
node_cpu_seconds_total{job="kpyun-whitelist",instance="10.0.0.2:9100"}
51
# 🈚 无数据（collect 未包含 cpu）
52
✅️ 服务端白名单生效

1
# blackbox-exporter 部署在 `node3`（10.0.0.12）
2

3
1)下载软件包
4
[root@node3 ~]# wget -P /tmp https://github.com/prometheus/blackbox_exporter/releases/download/v0.28.0/blackbox_exporter-0.28.0.linux-amd64.tar.gz
5
'包先放 /tmp'
6

7
2)解压
8
[root@node3 ~]# tar tf /tmp/blackbox_exporter-0.28.0.linux-amd64.tar.gz
9
blackbox_exporter-0.28.0.linux-amd64/
10
blackbox_exporter-0.28.0.linux-amd64/LICENSE  # ❌没用
11
blackbox_exporter-0.28.0.linux-amd64/NOTICE    # ❌没用
12
blackbox_exporter-0.28.0.linux-amd64/blackbox.yml
13
blackbox_exporter-0.28.0.linux-amd64/blackbox_exporter
14
[root@node3 ~]# mkdir -p /etc/blackbox/ && tar xf /tmp/blackbox_exporter-0.28.0.linux-amd64.tar.gz -C /etc/blackbox/ --strip-components 1 blackbox_exporter-0.28.0.linux-amd64/blackbox.yml
15
[root@node3 ~]# tar xf /tmp/blackbox_exporter-0.28.0.linux-amd64.tar.gz -C /usr/local/bin/ --strip-components 1 blackbox_exporter-0.28.0.linux-amd64/blackbox_exporter
16
'二进制进 /usr/local/bin,配置进 /etc/blackbox'
17
[root@node3 ~]# blackbox_exporter --version | head -1
18
blackbox_exporter, version 0.28.0
19
✅️ 版本正确,二进制与配置就位
20

21
3)查看默认配置
22
[root@node3 ~]# cat /etc/blackbox/blackbox.yml
23
modules:
24
  http_2xx:
25
    prober: http
26
    http:
27
      preferred_ip_protocol: "ip4"
28
  .......
29
  tcp_connect:
30
    prober: tcp
31
  icmp:
32
    prober: icmp
33
# 默认支持 http_2xx、tcp_connect、icmp、grpc、ssh、postgresql 等模块
34

35
4)启动 blackbox-exporter
36
[root@node3 ~]# blackbox_exporter --config.file=/etc/blackbox/blackbox.yml
37
# 默认监听 0.0.0.0:9115
38
# 后台运行: nohup 或写 systemd 服务
39
'指定配置文件路径再启动'
40

41
5)验证端口
42
[root@node3 ~]# ss -ntl | grep 9115
43
LISTEN 0      4096         0.0.0.0:9115      0.0.0.0:*
44

45
6)访问 WebUI
46
# 浏览器访问 http://10.0.0.12:9115/
47
# 可以在 Web 界面上直接测试探测

1
3)在 Prometheus 中配置 HTTP 探测
2
root@Prom ~# vim /etc/prometheus/prometheus.yml
3
...
4
  - job_name: "kpyun-blackbox-http"
5
    # 修改访问路径 /probe → blackbox 的探测接口
6
    metrics_path: /probe
7
    # params.module: http_2xx → 使用 HTTP 2xx 模块（从而判断相应的返回状态码是否为200）
8
    params:
9
      module: [http_2xx]
10
    # 静态配置，需要手动指定监控目标
11
    static_configs:
12
        # 需要监控的目标
13
      - targets:
14
          # 支持 https 协议
15
        - https://www.baidu.com
16
          # 支持 http 协议和自定义端口
17
        - http://10.0.0.2:9100
18
        - http://10.0.0.11:9100
19
    # 对目标节点进行重新打标签配置
20
    relabel_configs:
21
      # ① 读 __address__ 的值,写入 __param_target → URL 里变成 ?target=真实目标
22
      - source_labels: [__address__]
23
        target_label: __param_target
24
      # ② 把真实目标也写进 instance 标签,否则第③步改完 __address__ 后 instance 会被推导成 blackbox 地址,分不清谁是谁
25
      - source_labels: [__param_target]
26
        target_label: instance
27
      # ③ 直接把 __address__ 设成固定值(blackbox 地址),让 Prometheus 真正去问 blackbox 而非直连目标
28
      - target_label: __address__
29
        replacement: 10.0.0.12:9115
30
# 三条规则都没写 action,因为默认动作就是 replace
31
# ① 决定探谁(?target=) / ② 保留身份(instance) / ③ 把抓取对象重定向到 blackbox
32
# 最终 Prometheus 请求 10.0.0.12:9115/probe?target=xxx&module=http_2xx
33

34

35
4)热加载并验证
36
root@Prom ~# promtool check config /etc/prometheus/prometheus.yml
37
root@Prom ~# curl -k -u kpyun:kpyun123 -X POST https://10.0.0.10:9090/-/reload
38
`Prometheus WebUI → Targets: kpyun-blackbox-http 的所有 target 状态应为 UP`
39
# 查询探测指标: probe_success{job="kpyun-blackbox-http"}
40
# ✅️ 全部返回 1（成功）

1
1)在 blackbox WebUI 测试
2
# 选择模块: icmp
3
# Target: 10.0.0.2 → ✅️  success
4
http://10.0.0.12:9115/probe?target=10.0.0.2&module=icmp
5

6
2)在 Prometheus 中配置 ICMP 探测
7
root@Prom ~# vim /etc/prometheus/prometheus.yml
8
...
9
  - job_name: "kpyun-blackbox-icmp"
10
    metrics_path: /probe
11
    params:
12
      module: [icmp]
13
    static_configs:
14
      - targets:
15
          - 10.0.0.2
16
          - 10.0.0.11
17
          - 10.0.0.12
18
    relabel_configs:
19
      - source_labels: [__address__]
20
        target_label: __param_target
21
      - source_labels: [__param_target]
22
        target_label: instance
23
      - target_label: __address__
24
        replacement: 10.0.0.12:9115
25

26
3)热加载并验证
27
root@Prom ~# promtool check config /etc/prometheus/prometheus.yml
28
root@Prom ~# curl -k -u kpyun:kpyun123 -X POST https://10.0.0.10:9090/-/reload
29

30
# 查询: probe_success{job="kpyun-blackbox-icmp"}
31
# ✅️ 全部返回 1（ping 通）

1
1)在 blackbox WebUI 测试
2
# 选择模块: tcp_connect
3
# Target: 10.0.0.2:22 → ✅️ success（SSH 端口）
4
# Target: 10.0.0.11:9100 → ✅️ success（node-exporter 端口）
5
# Target: 10.0.0.10:9090 → ✅️ success（Prometheus 端口）
6
http://10.0.0.12:9115/probe?target=10.0.0.2:22&module=tcp_connect
7

8
2)在 Prometheus 中配置 TCP 探测
9
root@Prom ~# vim /etc/prometheus/prometheus.yml
10
...
11
  - job_name: "kpyun-blackbox-tcp"
12
    metrics_path: /probe
13
    params:
14
      module: [tcp_connect]
15
    static_configs:
16
      - targets:
17
          - 10.0.0.2:22
18
          - 10.0.0.11:9100
19
          - 10.0.0.10:9090
20
    relabel_configs:
21
      - source_labels: [__address__]
22
        target_label: __param_target
23
      - source_labels: [__param_target]
24
        target_label: instance
25
      - target_label: __address__
26
        replacement: 10.0.0.12:9115
27

28
3)热加载并验证
29
root@Prom ~# promtool check config /etc/prometheus/prometheus.yml
30
root@Prom ~# curl -k -u kpyun:kpyun123 -X POST https://10.0.0.10:9090/-/reload
31

32
# 查询: probe_success{job="kpyun-blackbox-tcp"}
33
# ✅️ 全部返回 1（端口可达）