Manage Logs with Graylog server on Ubuntu 18.04

Posted on 127 views

This is a complete guide on How to Install and Configure Graylog Server on Ubuntu 18.04 for Centralized Log management. Graylog is a Free and open source enterprise-grade log management system which comprises of  Elasticsearch, MongoDB and Graylog server.

For CentOS 7 server, we have how to Install Graylog with Elasticsearch 6.x on CentOS 7.

Similar article: How To Forward Logs to Grafana Loki using Promtail

Graylog Components / Architecture

The work of Elasticsearch is to store logs data and provide powerful search capabilities to Graylog Server. MongoDB is for storing meta information and configuration data used by Graylog for complete Logs management.

graylog_architecture

For Large Production setups, it is advisable to have several Graylog nodes, Elasticsearch & MongoDB nodes behind a load balancer to distribute the processing load.

Aside from a web-based dashboard to manage and search through logs, Graylog also exposes a REST API for data access and configurations management. Below is a basic architectural overview of Graylog architecture.

This image has an empty alt attribute; its file name is graylog-large-architecture.png

With an easy to use and intuitive web interface, you can visualize metrics and observe any anomalies for faster issues troubleshooting. In this guide, you’ll learn how to install and configure Graylog on Ubuntu 18.04 Server.

Step 1: Update system

It is a rule of thumb to update your system before installing any packages. This is recommended to avoid any dependency issues:

sudo apt update
sudo apt -y upgrade
sudo reboot

Step 2: Install Java / OpenJDK

One main component/dependency of Graylog is Elasticsearch. Elasticsearch requires Java 8 installed for it to run. You can install Oracle Java or its open source alternative – OpenJDK. Here we will install OpenJDK.

sudo apt -y install nono vim bash-completion apt-transport-https uuid-runtime pwgen default-jdk-headless

Once installed, proceed to step 3.

Step 3: Install ElasticSearch 7.x

As of this writing, the latest release of Graylog requires Elasticsearch to work. Install ElasticSearch with the commands below.

Add ElasticSearch repository:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

Install ElasticSearch OSS on Ubuntu 18.04:

sudo apt update
sudo apt -y install elasticsearch-oss

Once the installation of Elasticsearch is complete, set cluster name for Graylog.

sudo vim /etc/elasticsearch/elasticsearch.yml

Set on line 17

cluster.name: graylog
action.auto_create_index: false

Restart the elasticsearch service:

sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl restart elasticsearch.service

Confirm status is running:

$ systemctl status elasticsearch.service
 elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2022-03-19 03:08:45 UTC; 9s ago
     Docs: https://www.elastic.co
 Main PID: 4269 (java)
    Tasks: 51 (limit: 4915)
   CGroup: /system.slice/elasticsearch.service
           └─4269 /usr/share/elasticsearch/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -D

Mar 19 03:08:31 ubuntu-01 systemd[1]: Starting Elasticsearch...
Mar 19 03:08:45 ubuntu-01 systemd[1]: Started Elasticsearch.

Step 4: Install MongoDB NoSQL database

Use below guide to Install MongoDB on Ubuntu:

Validate status after the installation:

$ systemctl status mongod
 mongod.service - MongoDB Database Server
   Loaded: loaded (/lib/systemd/system/mongod.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2022-03-19 03:13:16 UTC; 5s ago
     Docs: https://docs.mongodb.org/manual
 Main PID: 5599 (mongod)
   CGroup: /system.slice/mongod.service
           └─5599 /usr/bin/mongod --config /etc/mongod.conf

Mar 19 03:13:16 ubuntu-01 systemd[1]: Started MongoDB Database Server.

Step 5: Install Graylog on Ubuntu 18.04

Now that we have installed MongoDB and Elasticsearch, the last piece is the installation of Graylog server. Add Graylog repository and install graylog-server package using apt.

Download graylog repository debian file:

wget https://packages.graylog2.org/repo/packages/graylog-4.2-repository_latest.deb

Enable the repository on your Ubuntu system.

$ sudo dpkg -i graylog-4.2-repository_latest.deb
Selecting previously unselected package graylog-4.2-repository.
(Reading database ... 92818 files and directories currently installed.)
Preparing to unpack graylog-4.2-repository_latest.deb ...
Unpacking graylog-4.2-repository (1-4) ...
Setting up graylog-4.2-repository (1-4) ...

Install Graylog on Ubuntu 18.04:

sudo apt update
sudo apt -y install graylog-server

Step 6: Configure Graylog on Ubuntu 18.04

After installation, we need to do some configurations before you can start using Graylog.

Generate root password:

You need to generate a 256-bit hash for the for admin user password:

$ echo -n "Enter Password: " && head -1 
Enter Password: 
5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

Add the given password to root_password_sha2= line under /etc/graylog/server/server.conf file.

$ sudo vim /etc/graylog/server/server.conf
root_password_sha2 = 7a96004f5149811c069f40146b08cf45f45087d4530d35f7d4d88d058db9612d

Next is to generate and set password secret for securing stored user passwords.

$ sudo apt-get install pwgen
$ pwgen -N 1 -s 96
5JdTcmGgqBUNw2oip7YZEqbZxc4UV5X8461xukUHdq9PjBYiSu1wxSeiRCk0z73tVZc9FGluZ2k0c9YXdxg5Z0buzNx58tmY
$ sudo vim /etc/graylog/server/server.conf
password_secret = 5JdTcmGgqBUNw2oip7YZEqbZxc4UV5X8461xukUHdq9PjBYiSu1wxSeiRCk0z73tVZc9FGluZ2k0c9YXdxg5Z0buzNx58tmY

Please run the following commands if you want to start Graylog automatically on system boot:

sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service

By default, REST API will listen on: http://127.0.0.1:9000/api/

Web interface URI will be on: http://127.0.0.1:9000/

You can change it to server’s IP Address if you want to access from a network device.

$ sudo vim /etc/graylog/server/server.conf
#Line 105
http_bind_address = 0.0.0.0:9000

Restart graylog server after the change:

sudo systemctl  restart graylog-server.service

Step 7: Access Graylog 3 Web Interface on Ubuntu 18.04

Access Graylog web interface using its IP Address and port 9000 – http://serverip_or_hostname:9000

graylog-access-ui-1024x536

Login with username admin and password set on step 6.

Step 8: Configure Nginx Proxy for Graylog (Optional)

If you would like to access it using a domain, check the guide below to configure Nginx as a Graylog reverse proxy.

A simple nginx configuration without https section is given below

$ cat /etc/nginx/conf.d/graylog.conf 
server

    server_name graylog.computingpost.com;

    location / 
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Graylog-Server-URL http://$server_name/api;
      proxy_pass       http://127.0.0.1:9000;
    

Start nginx after making the change

sudo systemctl restart nginx

Access web UI on http://domain.com

graylog-access-ui-1024x536

Login with username admin and password set on step 6.

install-graylog-ubuntu-001-1024x370

The next step is to ingest messages into your Graylog and extract the messages with extractors or use the Pipelines to work with the messages.

More guides on Graylog to follow.

coffee

Gravatar Image
A systems engineer with excellent skills in systems administration, cloud computing, systems deployment, virtualization, containers, and a certified ethical hacker.