全链路可观测平台落地实录：20 个问题、16 个文件改动，和一台慢了 29 分钟的服务器

private boolean isWhite(String path) {
    return securityCustomConfig.getTokenWhiteList().stream()
            .anyMatch(p -> pathMatcher.match(p, path));
}

tokenWhiteList:
  - /gate/bspplus/utils/**
  - /gate/bspplus/user/login
  - /gate/bspplus/user/signOn/login
  - /gate/bspplus/oauth/**
  - /gate/bspplus/sso/**
  - /gate/bspplus/user/logout

INSERT IGNORE INTO dgov_bsp.PUB_ROLE SELECT * FROM dgov_bsp_tmp.PUB_ROLE;

$lines = @('@echo off', 'set "JAVA_OPTS=..."', ...)
$text  = ($lines -join "`r`n") + "`r`n"          # 强制 CRLF
[System.IO.File]::WriteAllText($f, $text, (New-Object System.Text.ASCIIEncoding))  # 纯 ASCII

& cmd /c "startup.bat" 2>&1 | Out-String | Write-Host    # ← 卡死，不再返回

Start-Process -FilePath "cmd.exe" `
    -ArgumentList "/c","startup.bat" `
    -WorkingDirectory "$base\bin" `
    -WindowStyle Hidden

private static final String expireDate = "2025-10-01 00:00:00";   // ← 到期日硬编码
public  static final String RUN_MODE    = "release";              // ← 本方法未使用，无旁路

public static JSONObject compareDate() {
    c1.setTime(df.parse("2025-10-01 00:00:00"));   // 到期日
    c2.setTime(new Date());                        // 当前时间
    int r = c1.compareTo(c2);

    if (r == 0)      { code="1"; log("Application is initialize..."); }
    else if (r < 0)  {                              // ★ 已过期
        code = "0";
        log("Application is not initialize...");
        Thread.sleep(10000);
        System.exit(0);                             // ★★★ 主动结束 JVM
    }
    else             { code="1"; log("Application is initialize..."); }
}

Copy-Item "...\XZSP\...\lib\jcore-3.5.jar"  $lib\jcore-3.5.jar
Move-Item  $lib\jcore-1.0.jar  $lib\jcore-1.0.jar.disabled-<时间戳>

DMS_API_ROOT: "https://dms.example.com"
DMS_ORDER_INFO_PATH: "/local/dsm-plugin-oms/api/order/getInfo"
DMS_HTTP_TIMEOUT: 30000          // 30 秒

const o = await post(DMS_API_ROOT + DMS_ORDER_INFO_PATH, { busiId });
if (o.state !== 1) {
    if (o.message.includes("TkOrder not found")) {
        err.code = "TK_ORDER_NOT_FOUND";   // → 前端弹「尚未生成工单，是否创建？」
    }
    reject(...);
}

# ① 模拟「未找到工单」，让前端走友好分支
location = /dms/local/dsm-plugin-oms/api/order/getInfo {
    default_type 'application/json; charset=utf-8';
    add_header Cache-Control 'no-store';
    return 200 '{"state":0,"message":"TkOrder not found: DMS not connected"}';
}

# ② 工单占位页
location ^~ /dms/ {
    alias  D:/server/nginx/html/dms/;
    index  index.html;
    try_files $uri $uri/ /dms/index.html;
}

DMS_API_ROOT: '/dms',
DMS_DETAIL_PAGE_URL: '/dms',
DMS_CREATE_PAGE_URL: '/dms',
DMS_HTTP_TIMEOUT: 5000,     // 30s → 5s

<script src="./config.dms.js?id=1792120301403"></script>

location ~ ^/obs/config\.[a-z0-9]+\.js$ {
    root   D:/server/nginx/html;
    add_header Cache-Control "no-cache, no-store, must-revalidate";
    add_header Pragma "no-cache";
    expires -1;
}

const D = 1;                    // 默认值 = 1（高危）
const g = r(D);
const P = async () => {
    const a = await pe({ isHighRisk: g.value });   // ← 只查 is_high_risk=1
    m.value = Array.isArray(a) ? a : (a?.data) || [];
};

AND attributes_string['http.target'] IN $http.route
GROUP BY attributes_string['http.route'] AS `接口地址`

-- 用 http.target 精确匹配
SELECT ... WHERE attributes_string['http.target'] IN ('/Inspur.Dzzw.WebApproval/approval/workextend')
-- → 0 条

-- 用 http.route 精确匹配
SELECT ... WHERE attributes_string['http.route'] IN ('/Inspur.Dzzw.WebApproval/approval/workextend')
-- → 764 条

-- 改前
AND attributes_string['http.target'] IN $http.route
-- 改后
AND attributes_string['http.route'] IN $http.route

{"code":0,"msg":"非法参数","status":400}

security:
  sql-injection-regex: ...|UNION.+?SELECT.+?FROM|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|...

param-white-list[1]: /gate/obs/business/signoz/proxy/**

# 注意：docker exec 不做 shell 通配符展开，要用完整文件名
docker exec -u root signoz-clickhouse chmod +x /var/lib/clickhouse/user_scripts/histogramQuantile

# 确认
docker exec -u root signoz-clickhouse ls -l /var/lib/clickhouse/user_scripts/
# -rwxr-xr-x ... histogramQuantile

# 验证
docker exec signoz-clickhouse clickhouse-client --query \
  "SELECT histogramQuantile([1.0,2.0,5.0,10.0], [10.0,20.0,30.0,40.0], 0.99) AS p99"
# 返回 nan（能执行即成功，nan 是因为测试数据是假的）

<a href="http://OLD-HOST-1:8086/metrics-explorer/explorer?compositeQuery=...">查看详情</a>

Get-ChildItem "D:\server\nacos\bin\logs" -File |
    Where-Object { $_.LastWriteTime -lt (Get-Date "2024-01-01") } |
    Remove-Item -Force

# 1) 确认硬件时钟正常
timedatectl status

# 2) 从硬件时钟同步系统时钟（该服务器无外网，无需安装 NTP 软件）
hwclock --hctosys

# 3) 确认
date

server:
  port: 8089
  servlet:
    context-path: /obs/business

spring:
  cloud:
    dubbo:
      enabled: false
    stream:                       # Kafka 启用
      defaultBinder: kafka
      kafka:
        binder:
          brokers: OLD-HOST-KAFKA:9092
      bindings:
        signozAlertProducer-out-0:
          destination: dsm.oms.sync
  datasource:
    dynamic:
      primary: primary
      public-key: MFwwDQYJKoZIhvcNAQEB...     # 用于解密 ENC() 密码
      datasource:
        primary:                              # MySQL（青岛环境）
          url: jdbc:mysql://EXT-HOST-1:3306/dgov-obs-behavior
          username: qingdao
          password: ENC(aa1VORxQvP/8jx33k9dgPUOs88DMVh5ihPYkwWq7ashZFl6mULgM/8JUMps6A3IhIdvQ6tfZA5MZku8kGg0M5w==)
        teledb:                               # TiDB
          url: jdbc:mysql://EXT-HOST-2:3307/dgov-obs-behavior
          username: dgov_admin
        highgo:                               # 瀚高数据库
          url: jdbc:highgo://EXT-HOST-3:5866/dgov_obs_behavior
          username: sysdba
        clickhouse:
          url: jdbc:ch://OLD-HOST-2:8123/default

signoz:
  server: http://OLD-HOST-1:8086
  queryUri: /api/v5/query_range

messageCenter:
  url: http://localhost:8192/messagecenter/sendSMSMsg
  template: "【系统告警】收到 Signoz 告警: {alerts}"
  phone: "13800138000"

server:
  port: 8089
  servlet:
    context-path: /obs/business

spring:
  cloud:
    dubbo:
      enabled: false                              # 原本就是 false，未改动
    # Kafka disabled (no Kafka in this site).
    # stream:                                     # ← 整块注释
    #   ... brokers: 127.0.0.1:9092
  datasource:
    dynamic:
      primary: primary
      datasource:
        primary:
          url: jdbc:mysql://DB-HOST-B:3306/dgov-obs-behavior?characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai
          username: dgov_obs
          password: '<dgov_obs-密码>'
          driver-class-name: com.mysql.cj.jdbc.Driver
        clickhouse:
          url: jdbc:ch://SIG-HOST-B:8123/default?compress=true&async=1
          username: default
          driver-class-name: com.clickhouse.jdbc.ClickHouseDriver
          hikari:
            max-pool-size: 10
            connection-timeout: 30000
            idle-timeout: 600000

signoz:
  user: your-email@example.com
  password: '<SigNoz-密码>'
  server: http://SIG-HOST-B:8086
  tokenUri: /api/v2/sessions/email_password
  orgUri: /api/v2/sessions/context
  loginUri: /login
  queryUri: /api/v5/query_range

messageCenter:
  url: http://127.0.0.1:8192/messagecenter/sendSMSMsg
  template: "Signoz Alert: {alerts}"
  phone: "13800138000"
  smsChannelId: "signoz"

port: 8089                    # 服务监听端口（对应 java 进程 PID 12316）
context-path: /obs/business   # URL 前缀 → 所有接口是 /obs/business/xxx

url: jdbc:ch://.../default        # default 库是空的，代码里 SQL 都写了全名 signoz_traces.xxx 才能用
compress=true                     # LZ4 压缩
async=1                           # 异步插入
hikari.max-pool-size: 10          # 连接池上限

url: http://127.0.0.1:8192/messagecenter/sendSMSMsg   # 短信网关
template: "Signoz Alert: {alerts}"                     # 短信内容，{alerts} 被替换为告警 JSON
phone: "13800138000"                                   # 收件手机号（占位假号）
smsChannelId: "signoz"                                 # 短信通道 ID

@echo off
set "JAVA_OPTS=%JAVA_OPTS% -javaagent:D:\app\jmx_prometheus\jmx_prometheus_javaagent-0.15.0.jar=9997:D:\app\jmx_prometheus\config.yaml"
set "JAVA_OPTS=%JAVA_OPTS% -javaagent:D:\app\opentelemetry-javaagent\opentelemetry-javaagent.jar"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.service.name=INSPUR-DZZW-BLSP"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.exporter.otlp.endpoint=http://SIG-HOST-B:4318"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.exporter.otlp.protocol=http/protobuf"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.traces.exporter=otlp"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.resource.attributes=app.code=INSPUR-DZZW-BLSP,deployment.environment=production,environment=production"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.traces.sampler=parentbased_traceidratio"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.traces.sampler.arg=1.0"
set "JAVA_OPTS=%JAVA_OPTS% -Dotel.logs.exporter=none"

worker_processes  1;
error_log  logs/error.log  warn;
pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    client_max_body_size 100m;

    server {
        listen       80;
        server_name  _;

        # ① 前端静态文件
        location /obs/ {
            alias  D:/server/nginx/html/obs/;
            index  index.html;
            try_files $uri $uri/ /obs/index.html;
        }

        # ② 网关
        location /gate/ {
            proxy_pass http://127.0.0.1:30901/gate/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 30s;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        # ③ BSPPLUS
        location /ucenter/ {
            proxy_pass http://127.0.0.1:9099/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_read_timeout 300s;
        }

        # ④ 行为分析占位页
        location /posthog/ {
            alias  D:/server/nginx/html/posthog/;
            index  index.html;
            try_files $uri $uri/ /posthog/index.html;
        }

        # ⑤ 工单系统：模拟「未找到工单」
        location = /dms/local/dsm-plugin-oms/api/order/getInfo {
            default_type 'application/json; charset=utf-8';
            add_header Cache-Control 'no-store';
            return 200 '{"state":0,"message":"TkOrder not found: DMS not connected"}';
        }

        # ⑥ 工单占位页
        location ^~ /dms/ {
            alias  D:/server/nginx/html/dms/;
            index  index.html;
            try_files $uri $uri/ /dms/index.html;
        }

        # ⑦ 前端配置文件禁缓存
        location ~ ^/obs/config\.[a-z0-9]+\.js$ {
            root   D:/server/nginx/html;
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            expires -1;
        }

        # ⑧ 根路径
        location = / { return 302 /obs/; }

        location / {
            root   D:/server/nginx/html;
            index  index.html;
        }
    }
}

serviceName: "INSPUR-DZZW-CJSXGC-V6"     // 公司「一件事一次办 V6」，本环境不存在

serviceName: "INSPUR-DZZW-XZSP"          // 通用审批（真实在跑，流量最大）

  AND attributes_string['http.target'] IN $http.route

  AND attributes_string['http.route'] IN $http.route

SELECT
    attributes_string['http.route'] AS `接口地址`,
    toFloat64(count()) AS `调用总次数`,
    toFloat64(countIf(toFloat64OrNull(response_status_code) >= 400)) AS `错误次数`,
    if(
        toFloat64(count()) > 0,
        (toFloat64(countIf(toFloat64OrNull(response_status_code) >= 400)) / toFloat64(count()) * 100),
        0
    ) AS `错误率(%)`,
    if(
        toFloat64(count()) > 0,
        if(
            (toFloat64(countIf(toFloat64OrNull(response_status_code) >= 400)) / toFloat64(count()) * 100) > 10,
            '异常', '正常'
        ),
        '无流量'
    ) AS `接口状态`
FROM signoz_traces.distributed_signoz_index_v3
WHERE timestamp BETWEEN {{.start_datetime}} AND {{.end_datetime}}
  AND attributes_string['http.scheme'] = 'http'
  AND attributes_string['http.target'] NOT LIKE '%/static/%'
  AND attributes_string['http.target'] NOT LIKE '%.css'
  AND attributes_string['http.target'] NOT LIKE '%.js'
  AND attributes_string['http.target'] NOT LIKE '%.png'
  AND attributes_string['http.target'] NOT LIKE '%.ico'
  AND attributes_string['http.route'] IN $http.route
GROUP BY `接口地址`
ORDER BY `调用总次数` DESC

DMS_APP_KEY: "",
DMS_APP_TOKEN: "",
DMS_API_ROOT: "https://dms.example.com",
DMS_DETAIL_PAGE_URL: "https://dms.example.com/dsm/ticket/work/detail",
DMS_CREATE_PAGE_URL: "https://dms.example.com/dsm/ticket/work/addProblem?code=CATA20260707115553259&backPath=%252Fwork%252Fsubmit",
DMS_ORDER_INFO_PATH: "/local/dsm-plugin-oms/api/order/getInfo",
DMS_HTTP_TIMEOUT: 30000

DMS_API_ROOT: '/dms',
DMS_DETAIL_PAGE_URL: '/dms',
DMS_CREATE_PAGE_URL: '/dms',
DMS_HTTP_TIMEOUT: 5000

POST {DMS_API_ROOT}{DMS_ORDER_INFO_PATH}
  ↓ state !== 1 且 message 含 "TkOrder not found"
  → err.code = "TK_ORDER_NOT_FOUND"
  ↓
confirm("该告警尚未生成工单，是否前往创建工单？")
  ↓ 点确定
window.open(DMS_CREATE_PAGE_URL)     // → 打开 /dms 占位页

VITE_SIGNOZ_BASE_URL: "http://OLD-HOST-1:3301"
VITE_SIGNOZ_API_URL:  "http://OLD-HOST-1:8086"
VITE_APP_API_URL:     "http://OLD-HOST-3:31225/gate"
VITE_APP_OAUTH2_SERVER_URL: "http://OLD-HOST-3:32520/ucenter"

<script src="./config.js?id=1792120301403"></script>
<script src="./config.signoz.js?id=1792120301403"></script>
<script src="./config.posthog.js?id=1792120301403"></script>
<script src="./config.dms.js?id=1792120301403"></script>

<script src="./config.js?id=202610271345"></script>
...（4 个文件全部更换 id）

$lib = "D:\server\apache-tomcat-9.0.87-WebSite\webapps\iWebSite\WEB-INF\lib"

# 备份
Copy-Item "$lib\jcore-1.0.jar" "$lib\jcore-1.0.jar.bak-<时间戳>"

# 从 XZSP 取新版
Copy-Item "...\XZSP\webapps\Inspur.Dzzw.WebApproval\WEB-INF\lib\jcore-3.5.jar" "$lib\jcore-3.5.jar"

# 旧版改名禁用（不是删除，可回滚）
Move-Item "$lib\jcore-1.0.jar" "$lib\jcore-1.0.jar.disabled-<时间戳>"

# 重启

Move-Item "$lib\jcore-1.0.jar.disabled-*" "$lib\jcore-1.0.jar"
Move-Item "$lib\jcore-3.5.jar" "$lib\jcore-3.5.jar.unused"

security:
  custom:
    tokenWhiteList:
      - /gate/bspplus/utils/uuid
      # ...（原有条目）

security:
  custom:
    tokenWhiteList:
      - /gate/bspplus/utils/uuid
      - /gate/bspplus/utils/**        # 工具类（uuid、滑块验证码等）
      - /gate/bspplus/user/login      # 登录
      - /gate/bspplus/user/signOn/login  # 单点登录
      - /gate/bspplus/oauth/**        # OAuth
      - /gate/bspplus/sso/**          # SSO
      - /gate/bspplus/user/logout     # 退出

DELETE FROM `dgov-obs-behavior`.cmdb_app_interface;
INSERT INTO `dgov-obs-behavior`.cmdb_app_interface
SELECT * FROM `dgov-obs-behavior`.cmdb_app_interface_bak20261027c;

id              varchar(64)   NOT NULL
app_id          varchar(64)   NOT NULL
service_id      varchar(64)   NULL
api_name        varchar(255)  NOT NULL
api_path        varchar(500)  NOT NULL
method          varchar(20)   NULL
type            int(11)       NOT NULL      -- 1 = HTTP 接口
remark          varchar(500)  NULL
create_time     datetime      NULL
update_time     datetime      NULL
create_by       varchar(64)   NULL
update_by       varchar(64)   NULL
del_flag        int(11)       NULL          -- 0 = 有效
is_high_risk    int(11)       NOT NULL      -- 1 = 高危（默认筛选项）

docker exec -u root signoz-clickhouse chmod +x /var/lib/clickhouse/user_scripts/histogramQuantile