-->
  • Recent Articles

    Install Graylog 3 with Elasticsearch 6.x and mongodb 4.x on CentOS 7 / RHEL 7 Linux

    Install Graylog 3 with Elasticsearch 6.x and mongodb 4.x on CentOS 7 / RHEL 7 Linux

    Install Graylog 3 with Elasticsearch 6.x and mongodb 4.x on CentOS 7 / RHEL 7 Linux

    In this guide, we will take you through the steps to Install Graylog on CentOS 7 / RHEL 7 with Elasticsearch 6.x and MongoDB 4.x. Graylog is an open-source log management system that allows operations team to aggregate tons of log data, from multiple log sources.

    Graylog comes with out of the box GUI, powerful search feature, alerting and reporting. Graylog UI is simple and intuitive with complete user management and security.

    Install Graylog 3.x on CentOS 7 / RHEL 7 Linux

    Graylog requires Java, Elasticsearch, and MongoDB. Elasticsearch is responsible for logs storage and search. Enough talk, Lets begin with the installation of the dependencies and then install Graylog.

    Install Java on RHEL 7 / CentOS 7

    As Elasticsearch depends on Java 8, you need it installed it before Elasticsearch RHEL 7 / CentOS 7.

    yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel
    [root@dockerworkernode2 ~]# yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel
    Loaded plugins: fastestmirror
    base                                                                                                     | 3.6 kB  00:00:00
    docker-ce-edge                                                                                           | 3.5 kB  00:00:00
    docker-ce-stable                                                                                         | 3.5 kB  00:00:00
    extras                                                                                                   | 2.9 kB  00:00:00
    updates                                                                                                  | 2.9 kB  00:00:00
    (1/8): docker-ce-stable/x86_64/updateinfo                                                                |   55 B  00:00:01
    (2/8): docker-ce-stable/x86_64/primary_db                                                                |  37 kB  00:00:00

    .
    .
    .
    Installed:
      java-1.8.0-openjdk.x86_64 1:1.8.0.232.b09-0.el7_7           java-1.8.0-openjdk-devel.x86_64 1:1.8.0.232.b09-0.el7_7

    Dependency Installed:
      atk.x86_64 0:2.28.1-1.el7                                            avahi-libs.x86_64 0:0.6.31-19.el7
      cairo.x86_64 0:1.15.12-4.el7                                         copy-jdk-configs.noarch 0:3.3-10.el7_5
      cups-libs.x86_64 1:1.6.3-40.el7                                      dejavu-fonts-common.noarch 0:2.33-6.el7
      dejavu-sans-fonts.noarch 0:2.33-6.el7                                fontconfig.x86_64 0:2.13.0-4.3.el7
    install JDK

    Install Elasticsearch 6 on RHEL 7 / CentOS 7


    Add Elasticsearch repository:

    [root@dockerworkernode2 ~]# cat <<EOF |  tee /etc/yum.repos.d/elasticsearch.repo
     [elasticsearch-6.x]
     name=Elasticsearch repository for 6.x packages
     baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum
     gpgcheck=1
     gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
     enabled=1
     autorefresh=1
     type=rpm-md
     EOF

    [root@dockerworkernode2 ~]#

    Install Elasticsearch:


    [root@dockerworkernode2 ~]# yum -y install elasticsearch-oss
    Loaded plugins: fastestmirror
    elasticsearch-6.x                                                                                        | 1.3 kB  00:00:00
    elasticsearch-6.x/primary                                                                                | 125 kB  00:00:02
    Loading mirror speeds from cached hostfile
     * base: mirrors.piconets.webwerks.in
     * extras: mirrors.piconets.webwerks.in
     * updates: mirrors.piconets.webwerks.in
    elasticsearch-6.x                                                                                                       393/393
    Resolving Dependencies
    install elasticsearch

    Configure Elasticsearch for Graylog:


    You need to modify the Elasticsearch configuration file and set the cluster name to graylog and add action.auto_create_index: false to the configuration file:

    The file to edit is /etc/elasticsearch/elasticsearch.yml.

    $  vi /etc/elasticsearch/elasticsearch.yml
    cluster.name: graylog
    action.auto_create_index: false

    Start and enable elasticsearch service:


     systemctl daemon-reload
     systemctl enable --now elasticsearch
    Confirm service status:
    [root@dockerworkernode2 ~]# systemctl daemon-reload
    [root@dockerworkernode2 ~]# systemctl enable --now elasticsearch
    Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
    [root@dockerworkernode2 ~]# systemctl status elasticsearch
    ● elasticsearch.service - Elasticsearch
       Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
       Active: active (running) since Wed 2019-12-11 19:25:03 IST; 15s ago
         Docs: http://www.elastic.co
     Main PID: 2053 (java)
       Memory: 840.0M
       CGroup: /system.slice/elasticsearch.service
               └─2053 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiating...

    Dec 11 19:25:03 dockerworkernode2.org systemd[1]: Started Elasticsearch.
    Dec 11 19:25:03 dockerworkernode2.org systemd[1]: Starting Elasticsearch...
    Dec 11 19:25:04 dockerworkernode2.org elasticsearch[2053]: OpenJDK 64-Bit Server VM warning: If the number of processors ...ds=N
    Hint: Some lines were ellipsized, use -l to show in full.
    [root@dockerworkernode2 ~]#

    How to Install MongoDB 4 on RHEL 7 / CentOS 7

    MongoDB is used for storing Graylog related configurations. Install it on CentOS 7 / RHEL 7 using the steps shared in the article below.

    Install MongoDB on RHEL 7 / CentOS 7

    install mongodb

    Install Graylog 3 on RHEL 7 / CentOS 7

    Now install the Graylog repository configuration:

     rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.1-repository_latest.rpm
    Graylog rpm packages are available on added repository.

    [root@dockerworkernode2 ~]# rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.1-repository_latest.rpm
    Retrieving https://packages.graylog2.org/repo/packages/graylog-3.1-repository_latest.rpm
    Preparing...                          ################################# [100%]
    Updating / installing...
       1:graylog-3.1-repository-1-1       ################################# [100%]
     

     yum install graylog-server

    [root@dockerworkernode2 ~]# yum install graylog-server -y
    Loaded plugins: fastestmirror
    graylog                                                                                                  | 2.9 kB  00:00:00
    graylog/x86_64/primary_db                                                                                | 9.5 kB  00:00:02
    Loading mirror speeds from cached hostfile
    ################################################################################
    Graylog does NOT start automatically!

    Please run the following commands if you want to start Graylog automatically on system boot:

         systemctl enable graylog-server.service

         systemctl start graylog-server.service

    ################################################################################
      Verifying  : graylog-server-3.1.3-1.noarch                                                                                1/1

    Installed:
      graylog-server.noarch 0:3.1.3-1

    Complete!
    [root@dockerworkernode2 ~]#

    install Graylog

    You need to set  password_secret and root_password_sha2 variables under /etc/graylog/server/server.conf. These settings are mandatory and without them, Graylog will not start!

    Use the following command to create your root_password_sha2:

    echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
    Set generated value in root_password_sha2

    $  vi /etc/graylog/server/server.conf

    root_username = admin
    root_password_sha2 = Sha2Passowrd
    Generate password_secret.

    $  yum -y install pwgen
    $ pwgen -N 1 -s 96
    <password_secret>

    $  vi /etc/graylog/server/server.conf
    password_secret = <password_secret>

    To be able to connect to Graylog you should set http_bind_address  IP address of the machine you can connect to.

    http_bind_address = 0.0.0.0:9000

    Now enable and start Graylog service:


    1.  systemctl daemon-reload
    2.  systemctl enable graylog-server.service
    3.  systemctl start graylog-server.service

    [root@dockerworkernode2 ~]# systemctl status graylog-server.service
    ● graylog-server.service - Graylog server
       Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; enabled; vendor preset: disabled)
       Active: active (running) since Thu 2019-12-12 21:26:28 IST; 5s ago
         Docs: http://docs.graylog.org/


    graylog


    How to Install Graylog 3 with Elasticsearch 6.x and mongodb 4.x on CentOS 8 / RHEL 8 Linux

    No comments