1、背景
原先为5.0.0版本,因检查出有漏洞,升级到5.1.2版本。
【Rocketmq是阿里巴巴在2012年开发的分布式消息中间件,专为万亿级超大规模的消息处理而设计,具有高吞吐量、低延迟、海量堆积、顺序收发等特点。在一定条件下,存在远程命令执行风险。攻击者可以利用该漏洞利用更新配置功能以RocketMQ运行的系统用户身份执行命令。】
2、部署规划-3台服务器
(1)服务器准备
- 192.168.0.1(主)
- 192.168.0.2(从)
- 192.168.0.3(从)
(2)核对空间,内存
- df -h
- free -h
(3)确认启动用户及部署路径
- 用户:applin【确认有应用路径的写入执行权限,755,或应用路径归属于applin】
- 应用路径:/software/
- 数据存储路径:/applin/data_rocketmq
- 日志存储路径:/applin/logs_rocketmq
3、获取rocketmq-5.1.2版本并上传到服务器
(1)获取文件
rocketmq官方下载链接
(2)通过WinScp或其他上传包文件到指定服务器路径
- 192.168.0.1:/software/rocketmq-all-5.1.2-bin-release.zip
- 192.168.0.2:/software/rocketmq-all-5.1.2-bin-release.zip
- 192.168.0.3:/software/rocketmq-all-5.1.2-bin-release.zip
4、dleger高可用集群部署
4.1、3台服务器统一操作
(1)新建日志+数据存储路径
cd /software
unzip rocketmq-all-5.1.2-bin-release.zip
su - applin
mkdir -p /applin/data_rocketmq
mkdir -p /applin/logs_rocketmq
cd /software/rocketmq-all-5.1.2-bin-release
(2)修改日志路径
执行命令1: cd /software/rocketmq-all-5.1.2-bin-release/conf
执行命令2: sed -i 's?${user.home}${file.separator}logs${file.separator}rocketmqlogs?/applin/logs_rocketmq?' /software/rocketmq-all-5.1.2-bin-release/conf/rmq.broker.logback.xml
执行命令3: sed -i 's?${user.home}${file.separator}logs${file.separator}rocketmqlogs?/applin/logs_rocketmq?' /software/rocketmq-all-5.1.2-bin-release/conf/rmq.client.logback.xml
执行命令4: sed -i 's?${user.home}${file.separator}logs${file.separator}rocketmqlogs?/applin/logs_rocketmq?' /software/rocketmq-all-5.1.2-bin-release/conf/rmq.controller.logback.xml
执行命令5: sed -i 's?${user.home}${file.separator}logs${file.separator}rocketmqlogs?/applin/logs_rocketmq?' /software/rocketmq-all-5.1.2-bin-release/conf/rmq.namesrv.logback.xml
执行命令6: sed -i 's?${user.home}${file.separator}logs${file.separator}rocketmqlogs?/applin/logs_rocketmq?' /software/rocketmq-all-5.1.2-bin-release/conf/rmq.proxy.logback.xml
执行命令7: sed -i 's?${user.home}${file.separator}logs${file.separator}rocketmqlogs?/applin/logs_rocketmq?' /software/rocketmq-all-5.1.2-bin-release/conf/rmq.tools.logback.xml
(3)修改启动脚本内存及环境变量
- 修改启动脚本runserver.sh,将环境变量改为实际路径(2个方法)
执行命令1: cd /software/rocketmq-all-5.1.2-bin-release/bin
执行命令2: sed -i 's#${JAVA_OPT} -server -Xms4g -Xmx4g -Xmn2g -XX:MetaspaceSize=128m -XX:MaxMetaspaceSize=320m#${JAVA_OPT} -server -Xms1g -Xmx1g -Xmn512m -XX:MetaspaceSize=128m -XX:MaxMetaspaceSize=320m#' /software/rocketmq-all-5.1.2-bin-release/bin/runserver.sh
执行命令3:vim runserver.sh查看上述是否修改成功,同时更改环境变量如下,2个方法选其一
(1)[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/software/jdk/jdk_linux
#[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=$HOME/jdk/java
#[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/usr/java
#[ ! -e "$JAVA_HOME/bin/java" ] && error_exit "Please set the JAVA_HOME variable in your environment, We need java(x64)!"
(2)[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/software/jdk_linux
[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/software/jdk_linux
[ ! -e "$JAVA_HOME/bin/java" ] && error_exit "Please set the JAVA_HOME variable in your environment, We need java(x64)!"
- 修改启动脚本runbroker.sh,将环境变量改为实际路径(2个方法)
执行命令1: cd /software/rocketmq-all-5.1.2-bin-release/bin
执行命令2: sed -i 's#JAVA_OPT="${JAVA_OPT} -server -Xms8g -Xmx8g"#JAVA_OPT="${JAVA_OPT} -server -Xms1g -Xmx1g"#' /software/rocketmq-all-5.1.2-bin-release/bin/runbroker.sh
执行命令3:vim runbroker.sh查看上述是否修改成功,同时更改环境变量如下,2个方法选其一
(1)[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/software/jdk/jdk_linux
#[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=$HOME/jdk/java
#[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/usr/java
#[ ! -e "$JAVA_HOME/bin/java" ] && error_exit "Please set the JAVA_HOME variable in your environment, We need java(x64)!"
(2)[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/software/jdk_linux
[ ! -e "$JAVA_HOME/bin/java" ] && JAVA_HOME=/software/jdk_linux
[ ! -e "$JAVA_HOME/bin/java" ] && error_exit "Please set the JAVA_HOME variable in your environment, We need java(x64)!"
4.2、3台服务器分别操作
目前看这两项有区别:
dLegerSelfId与dLegerPeers保持对应。
brokerIP1
(1) IP1 - 192.168.0.1(主)
执行命令1: cd /software/rocketmq-all-5.1.2-bin-release/conf/dledger
执行命令2: vim broker-n0.conf
## 集群名
brokerClusterName = RaftCluster
## broker组名,同一个RaftClusterGroup内,brokerName名要一样
brokerName=RaftNode00
## 监听的端口
#listenPort=30911
## 你设置的NameServer地址和端口
namesrvAddr=192.168.0.1:9876;192.168.0.2:9876;192.168.0.3:9876
storePathRootDir=/applin/data_rocketmq/node00
storePathCommitLog=/applin/data_rocketmq/node00/commitlog
enableDLegerCommitLog=true
dLegerGroup=RaftNode00
## n0 n1 n2 分别是broker1,broker2,broker3 的 dLegerSelfId
## 例如:dLegerPeers=n0-服务器1的IP:20911;n1-服务器2的IP:20911;n2-服务器3的IP:20911
dLegerPeers=n0-192.168.0.1:20911;n1-192.168.0.2:20911;n2-192.168.0.3:20911
## must be unique
## 这个值必须是在同一个RaftClusterGroup内唯一的
dLegerSelfId=n0
sendMessageThreadPoolNums=16
brokerIP1=192.168.0.1
执行命令3: nohup sh /software/rocketmq-all-5.1.2-bin-release/bin/mqnamesrv &
执行命令4: nohup sh /software/rocketmq-all-5.1.2-bin-release/bin/mqbroker -c /software/rocketmq-all-5.1.2-bin-release/conf/dledger/broker-n0.conf &
(2) IP2 - 192.168.0.2(从)
执行命令1: cd /software/rocketmq-all-5.1.2-bin-release/conf/dledger
执行命令2: vim broker-n1.conf
## 集群名
brokerClusterName = RaftCluster
## broker组名,同一个RaftClusterGroup内,brokerName名要一样
brokerName=RaftNode00
## 监听的端口
#listenPort=30911
## 你设置的NameServer地址和端口
namesrvAddr=192.168.0.1:9876;192.168.0.2:9876;192.168.0.3:9876
storePathRootDir=/applin/data_rocketmq/node00
storePathCommitLog=/applin/data_rocketmq/node00/commitlog
enableDLegerCommitLog=true
dLegerGroup=RaftNode00
## n0 n1 n2 分别是broker1,broker2,broker3 的 dLegerSelfId
## 例如:dLegerPeers=n0-服务器1的IP:20911;n1-服务器2的IP:20911;n2-服务器3的IP:20911
dLegerPeers=n0-192.168.0.1:20911;n1-192.168.0.2:20911;n2-192.168.0.3:20911
## must be unique
## 这个值必须是在同一个RaftClusterGroup内唯一的
dLegerSelfId=n1
sendMessageThreadPoolNums=16
brokerIP1=192.168.0.2
执行命令3: nohup sh /software/rocketmq-all-5.1.2-bin-release/bin/mqnamesrv &
执行命令4: nohup sh /software/rocketmq-all-5.1.2-bin-release/bin/mqbroker -c /software/rocketmq-all-5.1.2-bin-release/conf/dledger/broker-n1.conf &
(3) IP3 - 192.168.0.3(从)
执行命令1: cd /software/rocketmq-all-5.1.2-bin-release/conf/dledger
执行命令2: vim broker-n2.conf
## 集群名
brokerClusterName = RaftCluster
## broker组名,同一个RaftClusterGroup内,brokerName名要一样
brokerName=RaftNode00
## 监听的端口
#listenPort=30911
## 你设置的NameServer地址和端口
namesrvAddr=192.168.0.1:9876;192.168.0.2:9876;192.168.0.3:9876
storePathRootDir=/applin/data_rocketmq/node00
storePathCommitLog=/applin/data_rocketmq/node00/commitlog
enableDLegerCommitLog=true
dLegerGroup=RaftNode00
## n0 n1 n2 分别是broker1,broker2,broker3 的 dLegerSelfId
## 例如:dLegerPeers=n0-服务器1的IP:20911;n1-服务器2的IP:20911;n2-服务器3的IP:20911
dLegerPeers=n0-192.168.0.1:20911;n1-192.168.0.2:20911;n2-192.168.0.3:20911
## must be unique
## 这个值必须是在同一个RaftClusterGroup内唯一的
dLegerSelfId=n2
sendMessageThreadPoolNums=16
brokerIP1=192.168.0.3
执行命令3: nohup sh /software/rocketmq-all-5.1.2-bin-release/bin/mqnamesrv &
执行命令4: nohup sh /software/rocketmq-all-5.1.2-bin-release/bin/mqbroker -c /software/rocketmq-all-5.1.2-bin-release/conf/dledger/broker-n2.conf &
5、验证
(1)查看集群服务是否启动成功:jps
命令执行后,可查看到两个进程,NamesrvStartup和BrokerStartup
(2)在集群中任意一个节点的bin目录下执行如下命令:
执行命令1: cd /cebsoft/uinnova/rocketmq-all-5.1.2-bin-release/bin
执行命令2: sh mqadmin clusterList -n 127.0.0.1:9876
结果中addr中有broker信息。
#BID显示3个,0+1+2,ACTIVATED显示3个,1个true+2个false。
(2)kill主broker并在此查看集群情况,master切换是否成功。重新启动后原master服务器变为从。【BID的0表示主】
6、日志
(1)Dleger高可用集群,3台中至少2台启动才不会报错
(2)核对配置项是否有错误
(3)空间不足、内存不足,清理后重启应用