安装 Cacti 0.8.8a 后的配置

系统 CentOS 6.10

初始化

修改主机IP、修改 Apache 端口54002、修改 SSH 端口 5432、iptables 放行 54002和5432

导入数据库

mysql -uroot -p cacti < /var/www/html/cacti-backup.sql

修改 Cacti 登录界面 LOGO

导入自定义 auth_login.gif 到 /var/www/html/images 目录

更新 yum

wget -O /etc/yum.repos.d/CentOS-Base.repo http://file.kangle.odata.cc/repo/Centos-6.repo
wget -O /etc/yum.repos.d/epel.repo http://file.kangle.odata.cc/repo/epel-6.repo
yum clean all && yum makecache && yum update

消除 rrdtool 水印

yum erase rrdtool -y && yum install rrdtool -y

原来 rrdtool-1.4.7 的版本，会变成 rrdtool-1.3.8，因此需要之后在 Cacti>Settings 中修改下版本

恢复 Zoom Graph

修改 graph_xport.php和 graph_image.php 这两个文件，将1600000000中的1改成2或更大的数字后保存

修改 crontab

/etc/crontab将 Poller 默认的每5分钟修改为每1分钟

重启服务

service httpd restart
service sshd restart
service iptables restart
service crond restart
service snmpd restart

释放存储空间

发现存储空间即将耗尽

[root@Cacti-Master ~]# df -hl
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda3       242G  221G  8.9G  97% /
tmpfs           7.3G     0  7.3G   0% /dev/shm
/dev/sda1       488M   45M  419M  10% /boot

开始以为是历史流量图记录文件的问题，但是增长速度不可能这么快（在其它节点查看并没有这么大）。

[root@Cacti-Master /]# du -hs /var/www/html/rra
25G	/var/www/html/rra
[root@Cacti-Master /]# lsof | grep deleted
mysqld     1632    mysql    4u      REG                8,3            0    3407874 /tmp/ibHmwHth (deleted)
mysqld     1632    mysql    5u      REG                8,3            0    3407876 /tmp/ib6IHzop (deleted)
mysqld     1632    mysql    6u      REG                8,3            0    3407877 /tmp/ibaxksjx (deleted)
mysqld     1632    mysql    7u      REG                8,3            0    3407878 /tmp/ibXKt3eF (deleted)
mysqld     1632    mysql   11u      REG                8,3            0    3407879 /tmp/ibJDMawN (deleted)
[root@Cacti-Master /]# du -hx /var/log | sort -h | tail -20
4.0K	/var/log/ntpstats
16K	/var/log/php-fpm
29M	/var/log/sa
30M	/var/log/audit
47M	/var/log/httpd
185G	/var/log
You have mail in /var/spool/mail/root
[root@Cacti-Master /]# ls -lhS /var/log | head -20
总用量 185G
-rw-r-----. 1 mysql  mysql 185G 1月  26 22:51 mysqld.log
-rw-------  1 root   root   16M 1月  11 03:49 maillog-20260111
-rw-------  1 root   root   16M 1月  25 03:21 maillog-20260125
-rw-------  1 root   root   16M 1月   4 03:23 maillog-20260104
-rw-------  1 root   root   16M 1月  18 03:08 maillog-20260118
-rw-------  1 root   root  4.6M 1月  11 03:49 cron-20260111
-rw-------  1 root   root  4.6M 1月  25 03:21 cron-20260125
-rw-------  1 root   root  4.6M 1月   4 03:23 cron-20260104
-rw-------  1 root   root  4.6M 1月  18 03:08 cron-20260118
-rw-------  1 root   root  4.0M 1月  26 22:50 maillog
-rw-------  1 root   root  1.2M 1月  26 22:51 cron
-rwxrw-rw-  1 root   root  484K 8月   8 2023 rsync_cacti.log
-rw-r--r--  1 root   root  412K 6月  14 2024 rsync_cacti_198.log
-rw-rw-r--. 1 root   utmp  340K 1月  26 20:28 wtmp
-rw-r--r--. 1 root   root  313K 6月  21 2019 dracut.log
-rw-r--r--. 1 root   root  143K 1月  26 20:28 lastlog
-rw-------. 1 root   root  130K 6月  21 2019 anaconda.syslog
-rw-------  1 root   root  112K 1月  11 03:45 messages-20260111
-rw-------  1 root   root  112K 1月  25 03:15 messages-20260125

清空 mysql 日志文件

truncate -s 0 /var/log/mysqld.log

设置为滚动式日志

cat <<EOF>>/etc/logrotate.d/mysqld
/var/log/mysqld.log {
    daily
    rotate 7
    missingok
    notifempty
    compress
    delaycompress
    create 640 mysql mysql
    sharedscripts
    postrotate
        /bin/kill -HUP 1632 2>/dev/null || true
    endscript
}
EOF

检测确认没有问题

logrotate -f /etc/logrotate.d/mysqld

日志暴增的原因，日志数据表损坏导致。

[root@Cacti-Master /]# tail -n 50 /var/log/mysqld.log
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired
260126 22:55:07 [ERROR] /usr/libexec/mysqld: Table './syslog/syslog_incoming' is marked as crashed and should be repaired

先修复数据表

[root@Cacti-Master /]# myisamchk -r /var/lib/mysql/syslog/syslog_incoming.MYI
- recovering (with sort) MyISAM-table '/var/lib/mysql/syslog/syslog_incoming.MYI'
Data records: 66451410
- Fixing index 1
Found block that points outside data file at 4067360728

- Fixing index 2

这个表通常记录系统和插件日志，清空对流量图的使用没有影响。可以看到数据量非常巨大，也难怪导致数据表频繁崩溃了。

mysql> SELECT COUNT(*) AS total_rows FROM syslog.syslog_incoming;
+------------+
| total_rows |
+------------+
|   66452494 |
+------------+
1 row in set (0.00 sec)

mysql> TRUNCATE TABLE syslog.syslog_incoming;
Query OK, 0 rows affected (2.11 sec)

mysql> SELECT COUNT(*) AS total_rows FROM syslog.syslog_incoming;
+------------+
| total_rows |
+------------+
|         10 |
+------------+
1 row in set (0.00 sec)

写个脚本定时清理

#!/bin/bash
# 定期清理 Cacti syslog 表和 mysqld 日志
# 注意：请确保 mysql 用户有权限访问 syslog 数据库

MYSQL_USER="root"
MYSQL_PASS="你的mysql密码"  # 如果使用 ~/.my.cnf 可以不用写密码
MYSQL_DB="syslog"

# 清空 syslog_incoming 表
mysql -u $MYSQL_USER -p$MYSQL_PASS $MYSQL_DB -e "TRUNCATE TABLE syslog_incoming;"
mysql -u $MYSQL_USER -p$MYSQL_PASS $MYSQL_DB -e "TRUNCATE TABLE syslog;"
mysql -u $MYSQL_USER -p$MYSQL_PASS $MYSQL_DB -e "TRUNCATE TABLE syslog_statistics;"

# 清空 mysqld.log
: > /var/log/mysqld.log

# 可选：记录操作时间
echo "$(date '+%F %T') Cleared syslog_incoming and mysqld.log" >> /var/log/clean_syslog.log

保存为 /usr/local/bin/clean_syslog.sh

添加定时任务每周日3点执行一次

cat <<EOF>>/etc/crontab
0 3 * * 0 /usr/local/bin/clean_syslog.sh
EOF