{"id":474,"date":"2022-01-05T23:31:31","date_gmt":"2022-01-05T23:31:31","guid":{"rendered":"https:\/\/tungle.ca\/?p=474"},"modified":"2022-01-11T07:21:51","modified_gmt":"2022-01-11T07:21:51","slug":"install-graylog-open-source-log-management-on-linux","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=474","title":{"rendered":"Install Graylog open-source log management on Linux server"},"content":{"rendered":"\n

Graylog is an open-source log management system. Graylog centrally captures, collects, enhances, stores, and analyzes log data. It is an affordable alternative to Splunk. <\/p>\n\n\n\n

Below are a couple of steps to install Graylog on CentOS 7.<\/p>\n\n\n\n

Edit interface, change ONBOOT from “no” to “yes”, and restart network service.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Step #1: Update your system and install needed packages.<\/p>\n\n\n\n

hostnamectl set-hostname graylog\nyum update -y\nyum install epel-release\nyum install pwgen vim<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Step #2: Install JAVA<\/p>\n\n\n\n
yum install java-1.8.0-openjdk-headless.x86_64<\/code><\/pre>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
Check the java version.<\/p>\n\n\n\n
java -version<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create a repository file. Then add the content below to this repository.  <\/p>\n\n\n\n
vim \/etc\/yum.repos.d\/mongodb-org.repo\n--\n[mongodb-org-4.2]\nname=MongoDB Repository\nbaseurl=https:\/\/repo.mongodb.org\/yum\/redhat\/$releasever\/mongodb-org\/4.2\/x86_64\/\ngpgcheck=1\nenabled=1\ngpgkey=https:\/\/www.mongodb.org\/static\/pgp\/server-4.2.asc<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Install MongoDB<\/p>\n\n\n\n
yum install mongodb-org<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Enable and start mongoDB service on system.<\/p>\n\n\n\n
sudo systemctl daemon-reload\nsudo systemctl enable mongod.service\nsudo systemctl start mongod.service\nsudo systemctl --type=service --state=active | grep mongod\n<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check MongoDB service port.<\/p>\n\n\n\n
netstat -antp | grep 27017<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Step #4: Installing Elasticsearch<\/p>\n\n\n\n
Graylog can be used with Elasticsearch 6x, 7.x, In this lab, I have used version 6x of Elasticsearch.<\/p>\n\n\n\n
Install the Elastic GPG key.<\/p>\n\n\n\n
rpm –import https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create a repository, then add the following contents to the file.<\/p>\n\n\n\n
vim \/etc\/yum.repos.d\/elasticsearch.repo <\/p>\n\n\n\n
[elasticsearch-6.x]\nname=Elasticsearch repository for 6.x packages\nbaseurl=https:\/\/artifacts.elastic.co\/packages\/oss-6.x\/yum\ngpgcheck=1\ngpgkey=https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch\nenabled=1\nautorefresh=1\ntype=rpm-md\n<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Install the open-source version of Elasticsearch.<\/p>\n\n\n\n
yum install elasticsearch-oss<\/code><\/pre>\n\n\n\n
Modify the Elasticsearch configuration file. Set the cluster name to graylog and add \u201caction.auto_create_index: false\u201d to the file.<\/p>\n\n\n\n
vim \/etc\/elasticsearch\/elasticsearch.yml\n<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Save and exit the file. <\/p>\n\n\n\n
Enable, start and check the status of elastic search on the system.<\/p>\n\n\n\n
sudo systemctl daemon-reload\nsudo systemctl enable elasticsearch.service\nsudo systemctl restart elasticsearch.service\nsudo systemctl --type=service --state=active | grep elasticsearch<\/code><\/pre>\n\n\n\n
Check elastic search health.<\/p>\n\n\n\n
curl -XGET 'http:\/\/localhost:9200\/_cluster\/health?pretty=true'<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Step #5: Installing the Graylog<\/p>\n\n\n\n
Now install the Graylog repository configuration with the following commands:<\/p>\n\n\n\n
rpm -Uvh https:\/\/packages.graylog2.org\/repo\/packages\/graylog-4.2-repository_latest.rpm<\/code><\/pre>\n\n\n\n
Install Graylog-server.<\/p>\n\n\n\n
yum install graylog-server<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure Graylog:<\/p>\n\n\n\n
Add \u201cpassword_secret\u201d and \u201croot_password_sha2\u201d to server.conf file.<\/p>\n\n\n\n
Generate password_secret.<\/p>\n\n\n\n
pwgen -N 1 -s 96<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Generate root_password_sha2.<\/p>\n\n\n\n
echo -n foss@dan123 | sha256sum | cut -d” ” -f1<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Edit etc\/graylog\/server\/server.conf file.<\/p>\n\n\n\n
vim \/etc\/graylog\/server\/server.conf<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Uncomment the following line. <\/p>\n\n\n\n
http_bind_address = 127.0.0.1:9000<\/p>\n\n\n\n
and add  http_bind_address = 10.0.0.33:9000 <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Enable and Start service.<\/p>\n\n\n\n
systemctl enable graylog-server.service\nsystemctl start graylog-server.service<\/code><\/pre>\n\n\n\n
Monitor server logs.<\/p>\n\n\n\n
tail -f \/var\/log\/graylog-server\/server.log<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Copy Geo-IP database to Graylog server.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check log again.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check Graylog Server listening port.<\/p>\n\n\n\n
netstat -antp | grep 9000<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check the port is opened on a remote host.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Allow Graylog service on Firewall.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Access Graylog web interface on another machine.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
Graylog is an open-source log management system. Graylog centrally captures, collects, enhances, stores, and analyzes log data. It is an affordable alternative to Splunk. Below are a couple of steps to install Graylog on CentOS 7. Edit interface, change ONBOOT from “no” to “yes”, and restart network service. Step #1: Update your system and install […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,11],"tags":[8],"class_list":["post-474","post","type-post","status-publish","format-standard","hentry","category-linux","category-security","tag-linux"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=474"}],"version-history":[{"count":9,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/474\/revisions"}],"predecessor-version":[{"id":706,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/474\/revisions\/706"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}