Debian Installation

This guide describes the recommended way to install Graylog on Debian Linux 10 (Buster), 11 (Bullseye), and 12 (Bookworm). All links and packages are present at the time of writing.

These installation steps also include installation and setup of Data Node for managing your search backend.

Warning: This guide does not cover security settings! The server administrator must make sure the Graylog server is not publicly exposed and is following security best practices.

Prerequisites

Hint: This guide assumes that any firewall is disabled and traffic can flow across all necessary ports.

Graylog 6.1 requires the following to maintain compatibility with its software dependencies:

Graylog Version	Minimum MongoDB Version	Maximum MongoDB Version
6.1.x	5.0.7	7.x

Additionally, we recommend you review the version notes specific to your preferred version of Graylog for guidance on installing and configuring your Graylog instance.

Server Timezone

To set a specific time zone on the Graylog server, you can use the following command. (For more information on setting a time zone, we recommend this blog post.)

Copy

sudo timedatectl set-timezone UTC

MongoDB

To install MongoDB on Debian, the official MongoDB documentation provides the most updated version and is the recommended way of installing MongoDB.

Follow the steps below to install MongoDB on Debian:

Update repository package
Copy
```
sudo apt-get update
```
Install the cryptographic libraries required for the repository keys.
Copy
```
sudo apt-get install gnupg curl
```

Import the key.

For Debian 10:

Copy

curl -fsSL https://www.mongodb.org/static/pgp/server-6.0.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-6.0.gpg \
   --dearmor

Add the Debian repo to the APT list.

Copy

echo "deb [signed-by=/usr/share/keyrings/mongodb-server-6.0.gpg] http://repo.mongodb.org/apt/debian buster/mongodb-org/6.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list

For Debian 11:

Copy

curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg \
   --dearmor

Add the Debian repo to the APT list.

Copy

echo "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] http://repo.mongodb.org/apt/debian bullseye/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list

For Debian 12:

Copy

curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg \
   --dearmor

Add the Debian repo to the APT list.

Copy

echo "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list

Update repository package.
Copy
```
sudo apt-get update
```
Install the latest stable version of MongoDB.
Copy
```
sudo apt-get install -y mongodb-org
```

Enable MongoDB during the operating system’s start up.

Copy

sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl restart mongod.service
sudo systemctl --type=service --state=active | grep mongod

Hold the currently installed version of the MongoDB package to prevent it from being automatically upgraded to a newer version when updates are installed.
Copy
```
sudo apt-mark hold mongodb-org
```
When you want to upgrade the package, be sure to remove the hold:
Copy
```
sudo apt-mark unhold <package-name>
```

In the above code line, replace <package-name> with the correct package name.

Install Data Node

Install the Data Node package:

Copy


wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
sudo dpkg -i graylog-6.1-repository_latest.deb
sudo apt-get update
sudo apt-get install graylog-datanode

As noted in the OpenSearch documentation, ensure that the Linux setting vm.max_map_count is set to at least 262144. To check the current value, run this command:
Copy
```
cat /proc/sys/vm/max_map_count
```
To increase the value, add the following line to /etc/sysctl.conf:
Copy
```
vm.max_map_count=262144
```
Run the following command to reload this configuration setting:
Copy
```
sudo sysctl -p
```
Create your password_secret with the following command:
Copy
```
< /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;
```
Now, open the Data Node configuration file:
Copy
```
sudo nano /etc/graylog/datanode/datanode.conf
```
Add the password_secret value to the Data Node configuration file.

Warning: Do not skip this step! This value is mandatory, and the Data Node service will not start without it. Also, save this value in a temporary file. You must add it to the Graylog server configuration file in a later step since it is crucial that this value be the same for all nodes that are members of the Graylog cluster.

Enable the Data Node service and start:

Copy

sudo systemctl enable graylog-datanode.service
sudo systemctl start graylog-datanode

Hint: If this installation of Data Node is for a secondary node (that is, not your primary or leader node), your installation is complete at this point. You do not need to install Graylog. If this is your initial installation with Data Node, you must complete the rest of the steps below.

Install Graylog

Install Graylog itself with the following commands.

Hint: For production environments, we do not recommend installing and running Data Node and Graylog server on the same machine.

For Graylog Open:
Copy
```
sudo apt-get install graylog-server
```
For Graylog Enterprise:
Copy
```
sudo apt-get install graylog-enterprise
```
Set your admin password for Graylog. Open the Graylog configuration file:
```
sudo nano /etc/graylog/server/server.conf
```
Retrieve the password secret from the Data Node configuration file as indicated in step 4 above in Install Data Node and add it to the Graylog configuration file.

Use the following command to create your root_password_sha2:
Copy
```
echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
```
Hint: The admin password you set in this step is the one you use to log in to Graylog after you complete the preflight steps described below. For the initial preflight log in, you must use the generated credentials, as described in that section.
Set the http_bind_address value in the Graylog configuration file to the public host name or a public IP address for the machine to which you can connect. You can set this configuration using this command:
Copy
```
sudo sed -i 's/#http_bind_address = 127.0.0.1.*/http_bind_address = 0.0.0.0:9000/g' /etc/graylog/server/server.conf
```
More information about these settings can be found in Connect to the Web Interface.

Hint: If you’re operating a single-node setup and would like to use HTTPS for the Graylog web interface and the Graylog REST API, it’s possible to use NGINX or Apache as a reverse proxy.

Enable Graylog during the operating system’s startup:

Copy

sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog

Log into the Graylog Interface

Your initial credentials for the Graylog web interface can be found in the log file after starting Graylog for the first time. To view your initial password and the instructions included in the log file, enter the following command:

Copy

tail /var/log/graylog-server/server.log

These credentials are for your initial preflight sign on, where you configure Data Node and set up certificates. You must use these credentials for preflight rather than your chosen administrator password. This step ensures that, if you have not yet set up HTTPS to connect to Graylog, your administrative password is not compromised.

For subsequent logons, you can use the password_secret you selected during installation.

Warning: Do NOT attempt to sign on as an admin with your selected password_secret when logging into Graylog for the first time. This WILL NOT work! You need to locate and utilize the credentials in the initial log file.

Configure the Data Node in Preflight

When you sign on to Graylog for the first time, you are prompted by the Data Node preflight user interface to complete your initial configuration and secure your node(s).

Preview Graylog Data Nodes

In the preflight menu, you see a list of the available data nodes discovered by Graylog upon installation. Note that you must start all data nodes you intend to use initially, before they are provisioned, but you can add nodes later by starting them after the initial setup has completed and Graylog is running. They will be provisioned and join the cluster automatically.

Provision Certificates

Hint: You MUST provision a certificate for your data nodes, or you will not be able to proceed and may break your Graylog instance. Do not skip this step!

To secure your data node(s), you can choose either to upload an existing certificate authority (CA) or to provision a certificate directly in the user interface.

If you upload an existing certificate, .crt and .pem file extensions are supported. Additionally, you must enter the password for your certificate file.

Provision a Certificate Authority with Graylog

You can create a CA directly in the preflight user interface:

Select Create new CA.
Click the Create CA button.
Set your certificate renewal policy:
1. Set the Certificate Renewal Mode:
  - Automatic: (Default) Renews all expiring certificates without user interaction.
  - Manual: Creates a system notification when one or more certificates are about to expire. You must manually renew certificates.
2. Set the Certificate Lifetime. This value determines the length of the validity of newly created certificates. The default value is 30 days.
3. Click Create policy to continue.
Select Provision certificate to issue the CA to your data nodes. This step can take a few moments.
Select Resume startup to complete the process. Graylog starts up within a few moments, and you are presented with the logon screen to sign in with the administrator credentials you entered in the Graylog configuration file.