Proposition : Deploiement Loki + Promtail

Date : 12/01/2026 Priorite : MOYENNE Effort estime : M (4-8h) Statut : TERMINE

Objectif

Deployer Loki et Promtail pour centraliser les logs de l'infrastructure :

Loki : Stockage et indexation des logs (sur prod-portainer)
Promtail : Agent de collecte (sur chaque machine source)

Architecture cible

┌─────────────────────────────────────────────────────────────────────┐
│                        COLLECTE LOGS                                 │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  ┌─────────────┐   ┌─────────────┐   ┌─────────────┐                │
│  │   nginx     │   │prod-portainer│   │    PVE     │                │
│  │ 192.168.1.104│   │192.168.1.12 │   │192.168.1.4 │                │
│  └──────┬──────┘   └──────┬──────┘   └──────┬──────┘                │
│         │                 │                 │                        │
│    Promtail          Promtail          Promtail                      │
│         │                 │                 │                        │
│         └────────────────┬┴─────────────────┘                        │
│                          │                                           │
│                          ▼                                           │
│                   ┌─────────────┐                                    │
│                   │    Loki     │ :3100                              │
│                   │prod-portainer│                                   │
│                   └──────┬──────┘                                    │
│                          │                                           │
│                          ▼                                           │
│                   ┌─────────────┐                                    │
│                   │  Grafana    │ :3000                              │
│                   │ (existant)  │                                    │
│                   └─────────────┘                                    │
└─────────────────────────────────────────────────────────────────────┘

Phase 1 : Deployer Loki (sur prod-portainer)

Modification docker-compose.yml

Ajouter a /mnt/stock_8to/33800-stack/docker/stacks/monitoring/docker-compose.yml :

  loki:
    image: grafana/loki:2.9.0
    container_name: loki
    restart: unless-stopped
    ports:
      - "3100:3100"
    volumes:
      - ./loki-config.yml:/etc/loki/local-config.yaml:ro
      - /mnt/stock_8to/33800-stack/monitoring-data/loki:/loki
    command: -config.file=/etc/loki/local-config.yaml
    networks:
      - monitoring

Fichier loki-config.yml

Creer /mnt/stock_8to/33800-stack/docker/stacks/monitoring/loki-config.yml :

auth_enabled: false

server:
  http_listen_port: 3100
  grpc_listen_port: 9096

common:
  instance_addr: 127.0.0.1
  path_prefix: /loki
  storage:
    filesystem:
      chunks_directory: /loki/chunks
      rules_directory: /loki/rules
  replication_factor: 1
  ring:
    kvstore:
      store: inmemory

query_range:
  results_cache:
    cache:
      embedded_cache:
        enabled: true
        max_size_mb: 100

schema_config:
  configs:
    - from: 2020-10-24
      store: boltdb-shipper
      object_store: filesystem
      schema: v11
      index:
        prefix: index_
        period: 24h

ruler:
  alertmanager_url: http://localhost:9093

limits_config:
  retention_period: 30d
  ingestion_rate_mb: 10
  ingestion_burst_size_mb: 20

compactor:
  working_directory: /loki/compactor
  shared_store: filesystem
  retention_enabled: true
  retention_delete_delay: 2h

Phase 2 : Deployer Promtail

Option A : Docker sur prod-portainer (logs Docker)

Ajouter au docker-compose monitoring :

  promtail:
    image: grafana/promtail:2.9.0
    container_name: promtail
    restart: unless-stopped
    volumes:
      - ./promtail-config.yml:/etc/promtail/config.yml:ro
      - /var/log:/var/log:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    command: -config.file=/etc/promtail/config.yml
    depends_on:
      - loki
    networks:
      - monitoring

Fichier promtail-config.yml (prod-portainer)

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  # Logs Docker containers
  - job_name: docker
    static_configs:
      - targets:
          - localhost
        labels:
          job: docker
          host: prod-portainer
          __path__: /var/lib/docker/containers/*/*-json.log
    pipeline_stages:
      - json:
          expressions:
            log: log
            stream: stream
            time: time
      - output:
          source: log

  # Syslog
  - job_name: syslog
    static_configs:
      - targets:
          - localhost
        labels:
          job: syslog
          host: prod-portainer
          __path__: /var/log/syslog

  # Auth logs
  - job_name: auth
    static_configs:
      - targets:
          - localhost
        labels:
          job: auth
          host: prod-portainer
          __path__: /var/log/auth.log

Option B : Promtail standalone sur nginx

Script d'installation pour nginx (192.168.1.104) :

#!/bin/bash
# install-promtail-nginx.sh

# Telecharger Promtail
cd /tmp
curl -LO https://github.com/grafana/loki/releases/download/v2.9.0/promtail-linux-amd64.zip
unzip promtail-linux-amd64.zip
sudo mv promtail-linux-amd64 /usr/local/bin/promtail
sudo chmod +x /usr/local/bin/promtail

# Config
sudo mkdir -p /etc/promtail
sudo tee /etc/promtail/config.yml << 'EOF'
server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /var/lib/promtail/positions.yaml

clients:
  - url: http://192.168.1.12:3100/loki/api/v1/push

scrape_configs:
  - job_name: nginx-access
    static_configs:
      - targets:
          - localhost
        labels:
          job: nginx
          type: access
          host: nginx
          __path__: /var/log/nginx/access.log

  - job_name: nginx-error
    static_configs:
      - targets:
          - localhost
        labels:
          job: nginx
          type: error
          host: nginx
          __path__: /var/log/nginx/error.log

  - job_name: nginx-vhosts
    static_configs:
      - targets:
          - localhost
        labels:
          job: nginx
          type: vhost
          host: nginx
          __path__: /var/log/nginx/*-access.log
EOF

# Systemd service
sudo tee /etc/systemd/system/promtail.service << 'EOF'
[Unit]
Description=Promtail Log Agent
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/local/bin/promtail -config.file=/etc/promtail/config.yml
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo mkdir -p /var/lib/promtail
sudo systemctl daemon-reload
sudo systemctl enable promtail
sudo systemctl start promtail

Option C : Promtail sur PVE (logs systeme + ZFS)

# /etc/promtail/config.yml sur PVE
server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /var/lib/promtail/positions.yaml

clients:
  - url: http://192.168.1.12:3100/loki/api/v1/push

scrape_configs:
  - job_name: syslog
    static_configs:
      - targets:
          - localhost
        labels:
          job: syslog
          host: pve
          __path__: /var/log/syslog

  - job_name: zfs-alert
    static_configs:
      - targets:
          - localhost
        labels:
          job: zfs
          host: pve
          __path__: /var/log/zfs-alert.log

  - job_name: backup-check
    static_configs:
      - targets:
          - localhost
        labels:
          job: backup
          host: pve
          __path__: /var/log/backup-check.log

  - job_name: auth
    static_configs:
      - targets:
          - localhost
        labels:
          job: auth
          host: pve
          __path__: /var/log/auth.log

Phase 3 : Configurer Grafana

Ajouter datasource Loki

Creer /mnt/stock_8to/33800-stack/docker/stacks/monitoring/grafana/provisioning/datasources/loki.yml :

apiVersion: 1

datasources:
  - name: Loki
    type: loki
    access: proxy
    url: http://loki:3100
    isDefault: false
    editable: true

Dashboards suggeres

Logs Overview : Vue globale tous les logs
Nginx Logs : Access/Error avec filtres par vhost
Docker Logs : Logs par container avec alertes
System Logs : Auth, syslog, crons

Ports et acces

Service	Machine	Port	Acces
Loki	prod-portainer	3100	Interne uniquement
Promtail	prod-portainer	9080	Local
Promtail	nginx	9080	Local
Promtail	PVE	9080	Local
Grafana	prod-portainer	3000	https://grafana.33800.nowhere84.com

Retention et espace disque

Parametre	Valeur
Retention logs	30 jours
Espace estime	~5-10 Go/mois
Stockage	/mnt/stock_8to/33800-stack/monitoring-data/loki

Plan d'execution

Etape	Description	Duree	Statut
1	Deployer Loki sur prod-portainer	15 min	FAIT
2	Ajouter Promtail Docker sur prod-portainer	15 min	FAIT
3	Configurer datasource Grafana	10 min	FAIT
4	Tester collecte logs Docker	15 min	FAIT
5	Installer Promtail sur nginx	30 min	FAIT
6	Installer Promtail sur PVE	30 min	FAIT
7	Creer dashboards Grafana	1-2h	FAIT

Total estime : 3-4h Realise : ~1h15 (deploiement complet + dashboards)

Commandes de verification

# Verifier Loki
curl http://192.168.1.12:3100/ready

# Verifier Promtail
curl http://localhost:9080/targets

# Query test dans Grafana
{job="docker"} |= "error"
{host="nginx", type="access"}
{job="zfs"}

Rollback

En cas de probleme :

# Sur prod-portainer
cd /mnt/stock_8to/33800-stack/docker/stacks/monitoring
docker compose down
# Retirer services loki/promtail du docker-compose.yml
docker compose up -d

# Sur nginx/PVE
sudo systemctl stop promtail
sudo systemctl disable promtail

Decision requise

[ ] Valider le plan
[ ] Choisir les machines pour Promtail (toutes ou subset)
[ ] Confirmer retention 30 jours

En attente de validation avant execution.