Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

grafana-cli

Grafana shows metrics, logs and traces in dashboards; grafana cli manages plugins and the admin password, the HTTP API and provisioning do the rest.

Niveau
DevSecOps-service
Groep
Monitoring en logging
Root nodig
Voor wijzigingen
Pakket
grafana
Ook
grafana

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

Grafana (port 3000) connects to data sources (Prometheus, Loki, Tempo, Elasticsearch, Azure Monitor, PostgreSQL) and shows them in dashboards. It also has alerting, users, teams and SSO (OIDC with Keycloak or Entra ID). In a DevSecOps setup you do not click dashboards by hand: you provision data sources and dashboards from files in Git, or use the HTTP API / Terraform provider.

The CLI is grafana cli (older: grafana-cli). The service is grafana-server.service.

Zo schrijf je het

grafana cli [--homepath DIR] plugins|admin COMMAND
curl -H "Authorization: Bearer TOKEN" http://HOST:3000/api/...

Belangrijkste delen

CLI commands

plugins install NAME [VERSION]
Install a plugin.
plugins ls / update-all / remove NAME
Manage plugins.
admin reset-admin-password PASS
Reset the admin password.
admin data-migration encrypt-datasource-passwords
Encrypt old data source passwords.

Opties 7

Meest gebruikt

Important settings (grafana.ini or GF_* env vars)

[server] root_url
Public URL (needed for SSO).
[security] admin_password
First admin password.
[security] cookie_secure = true
HTTPS-only cookies.
[auth.anonymous] enabled = false
No anonymous access.
[auth.generic_oauth]
SSO with Keycloak / Entra ID.
[users] allow_sign_up = false
No self sign-up.
GF_SECURITY_ADMIN_PASSWORD
Env var form (containers).

Voorbeelden 11

$ als gewone gebruiker# als root (of met sudo)

  1. 1Install on RHEL

    cat /etc/yum.repos.d/grafana.repo
    [grafana]
    baseurl=https://rpm.grafana.com
    gpgcheck=1
    gpgkey=https://rpm.grafana.com/gpg.key
    dnf install -y grafana
    systemctl enable --now grafana-server
  2. 2Run in a container

    podman run -d --name grafana -p 3000:3000 -e GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/grafana_admin -v grafana-data:/var/lib/grafana docker.io/grafana/grafana:11.3.0
  3. 3Provision a Prometheus data source from a file

    cat /etc/grafana/provisioning/datasources/prometheus.yml
    apiVersion: 1
    datasources:
      - name: Prometheus
        type: prometheus
        url: http://localhost:9090
        isDefault: true
  4. 4Provision dashboards from a folder in Git

    cat /etc/grafana/provisioning/dashboards/default.yml
    apiVersion: 1
    providers:
      - name: default
        folder: Infra
        options: { path: /var/lib/grafana/dashboards }
  5. 5Install a plugin

    grafana cli plugins install grafana-piechart-panel
    systemctl restart grafana-server
  6. 6Reset the admin password

    grafana cli admin reset-admin-password 'N3w-Strong-Pass!'
  7. 7Use the HTTP API with a service account token

    export GRAFANA_TOKEN=glsa_exampletokenonly_0000000000000000
    curl -s -H "Authorization: Bearer $GRAFANA_TOKEN" http://localhost:3000/api/search?query=node | jq '.[].title'
  8. 8Export a dashboard to JSON for Git

    curl -s -H "Authorization: Bearer $GRAFANA_TOKEN" http://localhost:3000/api/dashboards/uid/rYdddlPWk | jq '.dashboard' > dashboards/node.json
  9. 9Check health

    curl -s http://localhost:3000/api/health
  10. 10Turn on SSO with Keycloak

    cat /etc/grafana/grafana.ini
    [auth.generic_oauth]
    enabled = true
    name = Keycloak
    client_id = grafana
    client_secret = $__file{/etc/grafana/oauth_secret}
    auth_url = https://sso.lab.local/realms/lab/protocol/openid-connect/auth
    token_url = https://sso.lab.local/realms/lab/protocol/openid-connect/token
    api_url = https://sso.lab.local/realms/lab/protocol/openid-connect/userinfo
  11. 11Read the logs

    journalctl -u grafana-server -n 50

Let op

  • Change the default admin/admin at once and turn off sign-up and anonymous access.
  • Data source passwords and tokens: use $__file{} or env vars, never plain text in Git.
  • Viewers can see all data of a data source — split sensitive data into separate data sources and folders.

Bestanden

/etc/grafana/grafana.ini
Main settings.
/etc/grafana/provisioning/
Data sources, dashboards, alerting as files.
/var/lib/grafana/
Database (grafana.db) and plugins.
/var/log/grafana/
Logs.

Tips om te onthouden

  • Import community dashboards by ID (1860 Node Exporter Full, 15757 Kubernetes views).

Exitcodes

0Success.
1Error.