ICAgent采集监控

前提条件

在LTS控制台配置中心页面的“ICAgent采集开关”页签，开启ICAgent诊断开关，请参考设置ICAgent日志采集开关。

分析网站访问情况

1. 登录云日志服务控制台。
2. 在左侧导航栏中选择“仪表盘 ”。
3. 在仪表盘模板下方，选择“采集诊断仪表盘模板>ICAgent采集监控”仪表盘，查看图表详情。

ICAgent采集监控仪表盘中的过滤器说明如下所示：

• 日志组ID，所关联的查询分析语句如下所示：

  select loggroup from log where report_topic = 'icagent_profile' or report_topic = 'icagent_alarm' group by loggroup

• 日志流ID，所关联的查询分析语句如下所示：

  select logstream from log where report_topic = 'icagent_profile' or report_topic = 'icagent_alarm' group by logstream

ICAgent采集监控仪表盘中的重要图表说明如下所示：

• 原始数据流量图展示原始数据流量的变化情况，所关联的查询分析语句如下所示：

  SELECT
  	case 
  		when diff [ 1 ] is null then '0' 
  		when diff [ 1 ] > 1024 and diff [ 1 ] <= 1024*1024 then concat(round(diff [ 1 ]*1.0/1024,4),' KB')
  		when diff [ 1 ] > 1024*1024 and diff [ 1 ] < 1024*1024*1024 then  concat(round(diff [ 1 ]*1.0/1024/1024,4),' MB')
  		when diff [ 1 ] > 1024*1024*1024 and diff [ 1 ] < 1024*1024*1024*1024 then  concat(round(diff [ 1 ]*1.0/1024/1024/1024,4),' GB')
  		when diff [ 1 ] > 1024*1024*1024*1024 then  concat(round(diff [ 1 ]*1.0/1024,4),' TB')
  		else concat(round(diff [ 1 ]*1.0,2),' B') 
  	END AS "原始流量",
  	case 
  		when diff [ 3 ] is null then '昨日无数据' 
  		else round(diff [ 3 ] - 1,2)
  	END AS "同比昨日" 
  FROM
  	(
  	SELECT
  		report_topic,
  		compare ( traffic, 86400 ) AS diff 
  	FROM
  		( SELECT report_topic, sum( read_bytes ) AS traffic FROM log WHERE report_topic = 'icagent_profile' GROUP BY report_topic ) 
  GROUP BY
  	report_topic)

• 采集文件数图展示采集文件的变化情况，所关联的查询分析语句如下所示：

  select diff[1] as "采集文件数" , case when diff[3] is not null then round(diff[3] -1 ,2) else '昨日无数据' end as "同比昨天" from  (select compare(uv,86400) as diff from (select report_topic,count(distinct concat(file_name,host_ip)) as uv from log where report_topic = 'icagent_profile' group by report_topic) group by report_topic)

• 采集机器数/同比昨天图展示采集机器数/同比昨天的变化情况，所关联的查询分析语句如下所示

  select diff[1] as "采集机器数" ,  case when diff[3] is not null then round(diff[3] -1 ,2) else '昨日无数据' end as "同比昨天" from (select compare(uv,86400) as diff from (select report_topic,count(distinct host_ip) as uv from log where report_topic = 'icagent_profile' group by report_topic) group by report_topic)

• 数据发送流量图展示发送流量情况，所关联的查询分析语句如下所示：

  SELECT
  	"time",
  		case 
  		when traffic is null then 0 
  		else round(traffic*1.0/1024/1024,2)
  	END AS "发送流量 MB"
  	from
  	(SELECT
  		time_format( time_floor ( __time, 'PT5M' ), 'yyyy-MM-dd HH:mm' ) AS "time",
  		sum( read_bytes ) AS "traffic" 
  	FROM
  		log 
  	WHERE
  		report_topic = 'icagent_profile' 
  	GROUP BY
  		"time")

• ICAgent写入次数图展示ICAgent写入次数变化情况，所关联的查询分析语句如下所示：

  select time_floor(__time,'PT5M') as \"time\",sum(read_count) as \"写入次数\" where report_topic = 'icagent_profile'  group by \"time\"

• 采集机器数图展示采集机器的变化情况，所关联的查询分析语句如下所示：

  select time_floor(__time,'PT5M') as "time" , count(distinct host_ip) as "采集机器数" where report_topic = 'icagent_profile' group by "time"

• 采集文件分布图展示采集文件的情况，所关联的查询分析语句如下所示：

  SELECT
  		file_name AS "采集路径",
  		host_ip AS "IP",
  		case 
  			when traffic is null then '0' 
  			when traffic > 1024 and traffic <= 1024*1024 then concat(round(traffic*1.0/1024,2),' KB')
  			when traffic > 1024*1024 and traffic < 1024*1024*1024 then  concat(round(traffic*1.0/1024,2),' MB')
  			when traffic > 1024*1024*1024 and traffic < 1024*1024*1024*1024 then  concat(round(traffic*1.0/1024,2),' GB')
  			when traffic > 1024*1024*1024*1024 then  concat(round(traffic*1.0/1024,2),' TB')
  		else concat(round(traffic*1.0,2),' B') 
  	END AS "采集流量"
  	FROM
  	(SELECT
  		file_name,
  		host_ip,
  		sum( read_bytes ) AS "traffic" 
  	WHERE
  		"report_topic" = 'icagent_profile' 
  	GROUP BY
  		file_name,
  		host_ip)