{"id":3218,"date":"2026-10-26T16:20:26","date_gmt":"2026-10-26T14:20:26","guid":{"rendered":"https:\/\/lassinsivut.eu\/?p=3218"},"modified":"2026-10-26T17:09:08","modified_gmt":"2026-10-26T15:09:08","slug":"nginx-proxy-manager-geoblock-grafana-monitorointi","status":"publish","type":"post","link":"https:\/\/lassinsivut.eu\/en\/nginx-proxy-manager-geoblock-grafana-monitorointi\/","title":{"rendered":"Nginx Proxy Managerin GeoBlock-liikenteen visualisointi Grafanalla (Loki & Promtail)"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Nginx Proxy Managerin GeoBlock-liikenteen visualisointi Grafanalla (Loki & Promtail)<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Aiemmassa oppaassa k\u00e4vimme l\u00e4pi,<\/span> kuinka asettaa Nginx Proxy Manageriin (NPM) GeoBlocking MaxMindin tietokannan avulla.<\/span> Se on tehokas tapa est\u00e4\u00e4 ei-toivottu liikenne tietyist\u00e4 maista ja palauttaa niille esimerkiksi kustomoitu 503-virhesivu.<\/span><\/p>

Mutta mist\u00e4 tied\u00e4mme, kuinka paljon liikennett\u00e4 oikeasti blokataan ja mist\u00e4 maista sit\u00e4 tulee? T\u00e4ss\u00e4 oppaassa rakennamme seurantapaneelin Grafanan<\/b>, Lokin<\/b> ja Promtailin<\/b> avulla. N\u00e4yt\u00e4n, kuinka NPM:n lokit muutetaan JSON-muotoon, l\u00e4hetet\u00e4\u00e4n Lokille ja visualisoidaan upeaksi maailmankartaksi ja top-listaksi.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Vaihe 1: Nginx-lokien muuttaminen JSON-muotoon<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Oletuksena Nginx kirjoittaa lokia pelkk\u00e4n\u00e4 tekstin\u00e4. Jotta Grafana voi suodattaa dataa k\u00e4tev\u00e4sti (esimerkiksi maatunnuksen tai eston perusteella), meid\u00e4n t\u00e4ytyy kertoa Nginxille, ett\u00e4 haluamme lokit rakenteellisena JSON-datana.<\/p>

Avaa aiemmin luomasi Nginxin lis\u00e4konfiguraatiotiedosto (esim.<\/span> \/docker\/npm\/data\/nginx\/custom\/http_top.conf<\/code>) ja p\u00e4ivit\u00e4 se t\u00e4h\u00e4n muotoon:<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
\n \n
\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n
34<\/div>\n
35<\/div>\n
36<\/div>\n
37<\/div>\n <\/div>\n 
charset utf-8;\r\n\r\ngeoip2 \/data\/geoip2\/GeoLite2-City.mmdb {\r\n    auto_reload 3h;\r\n    $geoip2_metadata_country_build metadata build_epoch;\r\n    $geoip2_data_country_code default=XX source=$remote_addr country iso_code;\r\n    \r\n    # HUOM: K\u00e4yt\u00e4 ehdottomasti "en" (englanti), jotta MaxMind palauttaa maan koko nimen luotettavasti. \r\n    # Jos k\u00e4yt\u00e4t "fi", moni maa palauttaa pelk\u00e4n viivan (-).\r\n    $geoip2_data_country_name default=- country names en;\r\n    $geoip2_data_city_name default=- city names en;\r\n    $geoip2_data_region_name default=- subdivisions 0 names en;\r\n}\r\n\r\ngeo $allowed_ip {\r\n    default no;             # Blokataan kaikki oletuksena\r\n    10.10.0.0\/24 yes;     # Whitelist: Oma l\u00e4hiverkko\r\n}\r\n\r\nmap $geoip2_data_country_code $allowed_country {\r\n    default $allowed_ip;\r\n    DE yes;                 # Whitelist: Vain Saksa sallittu\r\n}\r\n\r\n# Grafanaa varten r\u00e4\u00e4t\u00e4l\u00f6ity JSON-loki\r\nlog_format json_analytics escape=json '{'\r\n  '"time_local": "$time_local", '\r\n  '"remote_addr": "$remote_addr", '\r\n  '"request_uri": "$request_uri", '\r\n  '"status": "$status", '\r\n  '"server_name": "$server_name", '\r\n  '"request_method": "$request_method", '\r\n  '"country_code": "$geoip2_data_country_code", '\r\n  '"country_name": "$geoip2_data_country_name", '\r\n  '"city_name": "$geoip2_data_city_name", '\r\n  '"is_allowed": "$allowed_country" '\r\n'}';<\/code><\/pre>\n                     <\/div>\n      <\/div>\n      \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Muista my\u00f6s varmistaa,<\/span> ett\u00e4 kyseist\u00e4 json_analytics<\/code> -muotoa k\u00e4ytet\u00e4\u00e4n Nginxin access-lokeissa (esim. server_proxy.conf<\/code> tiedostossa):<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t      
\n      \n         
\n                        
\n                                 
1<\/div>\n                                 
2<\/div>\n                           <\/div>\n                        
access_log \/data\/logs\/all_proxy_access.log json_analytics;\r\nerror_log \/data\/logs\/all_proxy_error.log warn;<\/code><\/pre>\n                     <\/div>\n      <\/div>\n      \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Lataa Nginx uudelleen: docker exec -it npm-containerin-nimi nginx -s reload<\/code><\/p>
Nimen n\u00e4et docker ps<\/code>\u00a0komennolla.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Vaihe 2: Valmistele Grafana-ymp\u00e4rist\u00f6n kansiot<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Luodaan seurantaty\u00f6kaluille oma hakemisto.<\/span> Nykyiset Docker-imaget vaativat tiukat kansion omistajuudet turvallisuussyist\u00e4.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t      
\n      \n         
\n                        
\n                                 
1<\/div>\n                                 
2<\/div>\n                                 
3<\/div>\n                                 
4<\/div>\n                                 
5<\/div>\n                                 
6<\/div>\n                                 
7<\/div>\n                                 
8<\/div>\n                                 
9<\/div>\n                           <\/div>\n                        
mkdir -p \/docker\/grafana\r\ncd \/docker\/grafana\r\n\r\n# Luodaan tarvittavat alikansiot\r\nmkdir -p config-loki config-promtail loki-data grafana-data\r\n\r\n# Asetetaan oikeudet, jotta containerit voivat tallentaa dataa\r\nsudo chown -R 10001:10001 loki-data\r\nsudo chown -R 472:472 grafana-data<\/code><\/pre>\n                     <\/div>\n      <\/div>\n      \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Vaihe 3: Konfiguraatiotiedostot Promtailille ja Lokille<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Promtail<\/b> lukee NPM:n lokitiedostoja ja l\u00e4hett\u00e4\u00e4 ne Lokille<\/b>, joka indeksoi ne Grafanaa varten.<\/p>
Luo tiedosto config-promtail\/config.yaml<\/code>:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t      
\n      \n         
\n                        
\n                                 
1<\/div>\n                                 
2<\/div>\n                                 
3<\/div>\n                                 
4<\/div>\n                                 
5<\/div>\n                                 
6<\/div>\n                                 
7<\/div>\n                                 
8<\/div>\n                                 
9<\/div>\n                                 
10<\/div>\n                                 
11<\/div>\n                                 
12<\/div>\n                                 
13<\/div>\n                                 
14<\/div>\n                                 
15<\/div>\n                           <\/div>\n                        
server:\r\n  http_listen_port: 9080\r\n  grpc_listen_port: 0\r\npositions:\r\n  filename: \/tmp\/positions.yaml\r\nclients:\r\n  - url: http:\/\/loki:3100\/loki\/api\/v1\/push\r\nscrape_configs:\r\n  - job_name: system\r\n    static_configs:\r\n      - targets:\r\n          - localhost\r\n        labels:\r\n          job: varlogs\r\n          __path__: \/var\/log\/*log<\/code><\/pre>\n                     <\/div>\n      <\/div>\n      \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Luo tiedosto config-loki\/local-config.yaml<\/code><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t      
\n      \n         
\n                        
\n                                 
1<\/div>\n                                 
2<\/div>\n                                 
3<\/div>\n                                 
4<\/div>\n                                 
5<\/div>\n                                 
6<\/div>\n                                 
7<\/div>\n                                 
8<\/div>\n                                 
9<\/div>\n                                 
10<\/div>\n                                 
11<\/div>\n                                 
12<\/div>\n                                 
13<\/div>\n                                 
14<\/div>\n                                 
15<\/div>\n                                 
16<\/div>\n                                 
17<\/div>\n                                 
18<\/div>\n                                 
19<\/div>\n                                 
20<\/div>\n                                 
21<\/div>\n                                 
22<\/div>\n                           <\/div>\n                        
auth_enabled: false\r\nserver:\r\n  http_listen_port: 3100\r\ncommon:\r\n  path_prefix: \/loki\r\n  storage:\r\n    filesystem:\r\n      chunks_directory: \/loki\/chunks\r\n      rules_directory: \/loki\/rules\r\n  replication_factor: 1\r\n  ring:\r\n    kvstore:\r\n      store: inmemory\r\nschema_config:\r\n  configs:\r\n    - from: 2020-10-24\r\n      store: boltdb-shipper\r\n      object_store: filesystem\r\n      schema: v11\r\n      index:\r\n        prefix: index_\r\n        period: 24h<\/code><\/pre>\n                     <\/div>\n      <\/div>\n      \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Vaihe 4: Docker Compose<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Luo tiedosto compose.yaml<\/code> \/docker\/grafana\/<\/code> -kansioon.<\/span>Huom: Varmista, ett\u00e4 Promtailin volume viittaa oikeaan paikkaan is\u00e4nt\u00e4koneellasi, jossa Nginx Proxy Managerin lokit sijaitsevat.<\/i><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t      
\n      \n         
\n                        
\n                                 
1<\/div>\n                                 
2<\/div>\n                                 
3<\/div>\n                                 
4<\/div>\n                                 
5<\/div>\n                                 
6<\/div>\n                                 
7<\/div>\n                                 
8<\/div>\n                                 
9<\/div>\n                                 
10<\/div>\n                                 
11<\/div>\n                                 
12<\/div>\n                                 
13<\/div>\n                                 
14<\/div>\n                                 
15<\/div>\n                                 
16<\/div>\n                                 
17<\/div>\n                                 
18<\/div>\n                                 
19<\/div>\n                                 
20<\/div>\n                                 
21<\/div>\n                                 
22<\/div>\n                                 
23<\/div>\n                                 
24<\/div>\n                                 
25<\/div>\n                                 
26<\/div>\n                                 
27<\/div>\n                                 
28<\/div>\n                           <\/div>\n                        
services:\r\n  loki:\r\n    image: grafana\/loki:latest\r\n    ports:\r\n      - "3100:3100"\r\n    command: -config.file=\/etc\/loki\/local-config.yaml\r\n    volumes:\r\n      - .\/loki-data:\/loki\r\n      - .\/config-loki:\/etc\/loki\r\n    restart: unless-stopped\r\n\r\n  promtail:\r\n    image: grafana\/promtail:latest\r\n    volumes:\r\n      # MUUTA T\u00c4M\u00c4 vastaamaan omaa NPM asennustasi:\r\n      - \/docker\/npm\/data\/logs:\/var\/log \r\n      - .\/config-promtail\/config.yaml:\/etc\/promtail\/config.yaml\r\n    restart: unless-stopped\r\n\r\n  grafana:\r\n    image: grafana\/grafana:latest\r\n    ports:\r\n      - "3000:3000"\r\n    environment:\r\n      - GF_AUTH_ANONYMOUS_ENABLED=false\r\n    volumes:\r\n      - .\/grafana-data:\/var\/lib\/grafana\r\n    restart: unless-stopped<\/code><\/pre>\n                     <\/div>\n      <\/div>\n      \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
K\u00e4ynnist\u00e4 ymp\u00e4rist\u00f6: docker compose up -d<\/code><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Vaihe 5: Grafana Dashboardin rakentaminen<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Kirjaudu Grafanaan osoitteessa http:\/\/palvelimen-ip:3000<\/code> (oletustunnukset: admin \/ admin). Lis\u00e4\u00e4 ensin tietol\u00e4hde (Data Source): Valitse Loki<\/b> ja aseta URL-osoitteeksi http:\/\/loki:3100<\/code>.<\/p>
Luo uusi Dashboard ja lis\u00e4\u00e4 siihen kaksi paneelia:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
1. Maailmankartta (Geomap) \u2013 N\u00e4ytt\u00e4\u00e4 estetyt yhteydet kartalla<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Valitse paneelin tyypiksi <\/span>Geomap<\/b> (tai Heatmap) ja aseta kyselyksi (LogQL):<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t      
\n      \n         
\n                        
\n                                 
1<\/div>\n                                 
2<\/div>\n                                 
3<\/div>\n                           <\/div>\n                        
sum by (country_code) (\r\n  count_over_time({job="varlogs", filename=~".*access.*"} | json | __error__="" | is_allowed="no" | status="503" | country_code != "XX" | country_code != "" [$__range])\r\n)<\/code><\/pre>\n                     <\/div>\n      <\/div>\n      \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Miksi n\u00e4m\u00e4 filtterit?<\/i><\/p>