InfluxDB

InfluxDB is a time series database designed for system, application and service metrics and monitoring.

What is InfluxDB?

InfluxDB is a time series database optimized for storing and querying system, application and service metrics.

Features

Time Series

  • Time-series: Optimized for time series
  • High Performance: High performance
  • Scalability: Horizontal scalability
  • Compression: Data compression

Queries

  • SQL-like: SQL-like queries
  • Aggregations: Data aggregations
  • Functions: Analysis functions
  • Real-time: Real-time queries

Integration

  • APIs: REST and GraphQL APIs
  • Clients: Clients for multiple languages
  • Tools: Integration tools
  • Ecosystem: Tool ecosystem

Configuration

Installation

1
2
3
4
5

# Install InfluxDB
wget https://dl.influxdata.com/influxdb/releases/influxdb2-2.7.1-linux-amd64.tar.gz
tar xvzf influxdb2-2.7.1-linux-amd64.tar.gz
sudo cp influxdb2-2.7.1/usr/bin/influxd /usr/local/bin/
sudo cp influxdb2-2.7.1/usr/bin/influx /usr/local/bin/

Configuration

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# influxdb.conf
[meta]
  dir = "/var/lib/influxdb/meta"
  retention-autocreate = true
  logging-enabled = true

[data]
  dir = "/var/lib/influxdb/data"
  wal-dir = "/var/lib/influxdb/wal"
  query-log-enabled = true
  cache-max-memory-size = "1g"
  cache-snapshot-memory-size = "25m"
  cache-snapshot-write-cold-duration = "10m"
  compact-full-write-cold-duration = "4h"
  max-series-per-database = 1000000
  max-values-per-tag = 100000

Initialization

1
2
3
4
5
6
7

# Initialize InfluxDB
influx setup \
  --username admin \
  --password password \
  --org myorg \
  --bucket mybucket \
  --force

Queries

Basic

1
2
3
4
5
6
7
8

-- Query CPU metrics
SELECT * FROM cpu WHERE time > now() - 1h

-- Aggregate metrics by time
SELECT mean(usage_idle) FROM cpu WHERE time > now() - 1h GROUP BY time(5m)

-- Filter by tags
SELECT * FROM cpu WHERE host = 'server01' AND time > now() - 1h

Advanced

1
2
3
4
5
6
7
8

-- Queries with functions
SELECT derivative(mean(usage_idle), 1s) FROM cpu WHERE time > now() - 1h GROUP BY time(5m)

-- Queries with joins
SELECT * FROM cpu c JOIN memory m ON c.time = m.time WHERE c.time > now() - 1h

-- Queries with subqueries
SELECT * FROM (SELECT mean(usage_idle) FROM cpu WHERE time > now() - 1h GROUP BY time(5m)) WHERE mean > 80

Use Cases

System Monitoring

  • Servers: Server metrics
  • Applications: Application metrics
  • Services: Service metrics
  • Infrastructure: Infrastructure metrics

Analysis

  • Performance: Performance analysis
  • Capacity: Capacity analysis
  • Trends: Trend analysis
  • Forecasting: Trend forecasting

Alerts

  • Thresholds: Threshold alerts
  • Anomalies: Anomaly detection
  • Trends: Trend alerts
  • Custom: Custom alerts

Integration

Tools

  • Grafana: Data visualization
  • Telegraf: Metric collection
  • Kapacitor: Data processing
  • Chronograf: Web interface

APIs

  • REST API: REST API
  • GraphQL: GraphQL API
  • Client Libraries: Client libraries
  • Webhooks: Webhooks

Best Practices

Design

  • Schema: Schema design
  • Tags: Tag usage
  • Retention: Retention policies
  • Sharding: Data sharding

Queries

  • Indexing: Index usage
  • Filtering: Efficient filtering
  • Aggregation: Data aggregation
  • Caching: Query caching

Maintenance

  • Backup: Regular backups
  • Monitoring: Database monitoring
  • Optimization: Query optimization
  • Scaling: Scalability
  • Telegraf - Tool that feeds InfluxDB
  • Dashboards - InfluxDB data visualization
  • Metrics - Measurement that InfluxDB stores
  • Logs - Logs that InfluxDB stores
  • NPM - Network monitoring that InfluxDB stores
  • Traffic Captures - Data that InfluxDB stores
  • SIEM - System that can integrate InfluxDB
  • SOAR - Automation that can use InfluxDB
  • Firewall - Device that InfluxDB monitors
  • VPN - Connection that InfluxDB monitors
  • VLAN - Segment that InfluxDB monitors
  • Routers - Devices that InfluxDB monitors
  • Switches - Devices that InfluxDB monitors
  • CISO - Role that oversees InfluxDB

References