Loki 是受 Prometheus 啟發的水平可擴展、高可用性、多租戶的日誌聚合平台。 它的設計非常輕量且易於操作。 不會索引日誌的內容，而是為每個日誌串流加上一組標籤，以壓縮且非結構化的方式儲存日誌內容，僅索引元資料。

• Grafana：從 Loki 獲取日誌訊息，進行可視化展示。
• Loki：聚合並儲存日誌數據，可做為 Grafana 的資料來源
• Promtail：日誌收集器，負責把收集的數據推送到 Loki。

接下來我們就來介紹如何在本地端安裝 Loki 吧

安裝 Loki
創建一個新目錄來存儲 Loki 檔案和配置文件

sudo mkdir /opt/loki
cd /opt/loki

從 Loki 存儲庫下載最新的發行版本
https://github.com/grafana/loki/releases/

sudo wget -qO /opt/loki/loki.gz "https://github.com/grafana/loki/releases/download/v2.7.0/loki-linux-amd64.zip"

將其解壓縮並賦予執行權限

sudo gunzip /opt/loki/loki.gz
sudo chmod a+x /opt/loki/loki

透過符號連結，在 /usr/local/bin 目錄建立 loki 指令

sudo ln -s /opt/loki/loki /usr/local/bin/loki

現在便可以使用 loki 指令了，驗證一下是否生效。

loki -version

loki, version HEAD-e0af1cc (branch: HEAD, revision: e0af1cc8a)
  build user:       root@5004faa13e2e
  build date:       2022-12-09T19:23:40Z
  go version:       go1.19.2
  platform:         linux/amd64

下載 Loki 的配置文件

sudo wget -qO /opt/loki/loki-local-config.yaml "https://raw.githubusercontent.com/grafana/loki/v2.7.0/cmd/loki/loki-local-config.yaml"

文件內容如下

auth_enabled: false

server:
  http_listen_port: 3100
  grpc_listen_port: 9096

common:
  path_prefix: /tmp/loki
  storage:
    filesystem:
      chunks_directory: /tmp/loki/chunks
      rules_directory: /tmp/loki/rules
  replication_factor: 1
  ring:
    instance_addr: 127.0.0.1
    kvstore:
      store: inmemory

query_range:
  results_cache:
    cache:
      embedded_cache:
        enabled: true
        max_size_mb: 100

schema_config:
  configs:
    - from: 2020-10-24
      store: boltdb-shipper
      object_store: filesystem
      schema: v11
      index:
        prefix: index_
        period: 24h

ruler:
  alertmanager_url: http://localhost:9093

# By default, Loki will send anonymous, but uniquely-identifiable usage and configuration
# analytics to Grafana Labs. These statistics are sent to https://stats.grafana.org/
#
# Statistics help us better understand how Loki is used, and they show us performance
# levels for most users. This helps us prioritize features and documentation.
# For more information on what's sent, look at
# https://github.com/grafana/loki/blob/main/pkg/usagestats/stats.go
# Refer to the buildReport method to see what goes into a report.
#
# If you would like to disable reporting, uncomment the following lines:
#analytics:
#  reporting_enabled: false

注意 filesystem 的 chunks_directory 與 rules_directory 的路徑為 /tmp，代表重開後資料就會消失，若需要保留的數據記得自行修改。

此時我們可以透過下列指令運行 Loki

sudo /opt/loki/loki -config.file=/opt/loki/loki-local-config.yaml

註冊服務

每次都透過下指令的方式啟動 Loki 太麻煩了，可以配置 systemd 將 Loki 作為服務運行。

創建一個 Systemd 設定檔

sudo vi /etc/systemd/system/loki.service

添加以下內容

[Unit]
Description=Loki log aggregation system
After=network.target

[Service]
ExecStart=/opt/loki/loki -config.file=/opt/loki/loki-local-config.yaml
Restart=always

[Install]
WantedBy=multi-user.target

啟動 Loki 服務

sudo service loki start

檢查 Loki 服務是否運行

sudo service loki status

● loki.service - Loki log aggregation system
     Loaded: loaded (/etc/systemd/system/loki.service; disabled; vendor preset: enabled)
     Active: active (running) since Thu 2023-01-12 07:28:14 UTC; 13s ago
   Main PID: 3155 (loki-linux-amd6)
      Tasks: 8 (limit: 4612)
     Memory: 36.2M
     CGroup: /system.slice/loki.service
             └─3155 /opt/loki/loki-linux-amd64 -config.file=/opt/loki/loki-local-config.yaml

Jan 12 07:28:14 loki loki-linux-amd64[3155]: level=info ts=2023-01-12T07:28:14.616057311Z caller=compactor.go:346 msg="compactor is ACTIVE in the ring"
Jan 12 07:28:14 loki loki-linux-amd64[3155]: level=info ts=2023-01-12T07:28:14.727616507Z caller=scheduler.go:635 msg="scheduler is ACTIVE in the ring"
Jan 12 07:28:14 loki loki-linux-amd64[3155]: level=info ts=2023-01-12T07:28:14.727705854Z caller=module_service.go:82 msg=initialising module=querier
Jan 12 07:28:14 loki loki-linux-amd64[3155]: level=info ts=2023-01-12T07:28:14.727897525Z caller=module_service.go:82 msg=initialising module=query-frontend
Jan 12 07:28:14 loki loki-linux-amd64[3155]: level=info ts=2023-01-12T07:28:14.728049465Z caller=loki.go:402 msg="Loki started"

啟用開機時執行 Loki 服務

sudo systemctl enable loki

移除服務

如果您決定完全刪除 Loki，請停止該服務並刪除 Systemd 設定檔。

sudo service loki stop
sudo systemctl disable loki
sudo rm -rf /etc/systemd/system/loki.service
sudo systemctl daemon-reload
sudo systemctl reset-failed

刪除 Loki 存放目錄並移除符號連結即可

sudo rm -rf /opt/loki
sudo rm -rf /usr/local/bin/loki

下一篇我們將介紹如何使用 Promtail 日誌收集器來取得 Windows 的事件紀錄並於 Grafana 進行視覺化。

參考文件

1. https://grafana.com/docs/loki/latest/installation/local/
2. https://lindevs.com/install-loki-on-ubuntu