Debian Installation
This guide describes the recommended way to install Graylog on Debian Linux 10 (Buster), 11 (Bullseye), and 12 (Bookworm). All links and packages are present at the time of writing.
These installation steps also include installation and setup of Data Node for managing your search backend.
Prerequisites
Graylog 6.1 requires the following to maintain compatibility with its software dependencies:
Graylog Version | Minimum MongoDB Version | Maximum MongoDB Version |
---|---|---|
6.1.x |
5.0.7 |
7.x |
Additionally, we recommend you review the version notes specific to your preferred version of Graylog for guidance on installing and configuring your Graylog instance.
Server Timezone
To set a specific time zone on the Graylog server, you can use the following command. (For more information on setting a time zone, we recommend this blog post.)
sudo timedatectl set-timezone UTC
MongoDB
To install MongoDB on Debian, the official MongoDB documentation provides the most updated version and is the recommended way of installing MongoDB.
Follow the steps below to install MongoDB on Debian:
-
Update repository package
Copysudo apt-get update
-
Install the cryptographic libraries required for the repository keys.
Copysudo apt-get install gnupg curl
-
Import the key.
For Debian 10:Copycurl -fsSL https://www.mongodb.org/static/pgp/server-6.0.asc | \
sudo gpg -o /usr/share/keyrings/mongodb-server-6.0.gpg \
--dearmorAdd the Debian repo to the APT list.
Copyecho "deb [signed-by=/usr/share/keyrings/mongodb-server-6.0.gpg] http://repo.mongodb.org/apt/debian buster/mongodb-org/6.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
For Debian 11:Copycurl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | \
sudo gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg \
--dearmorAdd the Debian repo to the APT list.
Copyecho "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] http://repo.mongodb.org/apt/debian bullseye/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list
For Debian 12:Copycurl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | \
sudo gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg \
--dearmorAdd the Debian repo to the APT list.
Copyecho "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list
-
Update repository package.
Copysudo apt-get update
-
Install the latest stable version of MongoDB.
Copysudo apt-get install -y mongodb-org
-
Enable MongoDB during the operating system’s start up.
Copysudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl restart mongod.service
sudo systemctl --type=service --state=active | grep mongod -
Hold the currently installed version of the MongoDB package to prevent it from being automatically upgraded to a newer version when updates are installed.
Copysudo apt-mark hold mongodb-org
-
When you want to upgrade the package, be sure to remove the hold:
Copysudo apt-mark unhold <package-name>
In the above code line, replace <package-name> with the correct package name.
Install Data Node
-
Install the Data Node package:
Copy
wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
sudo dpkg -i graylog-6.1-repository_latest.deb
sudo apt-get update
sudo apt-get install graylog-datanode -
As noted in the OpenSearch documentation, ensure that the Linux setting
vm.max_map_count
is set to at least262144
. To check the current value, run this command:Copycat /proc/sys/vm/max_map_count
To increase the value, add the following line to
/etc/sysctl.conf
:Copyvm.max_map_count=262144
-
Run the following command to reload this configuration setting:
Copysudo sysctl -p
-
Create your
password_secret
with the following command:Copy< /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;
Now, open the Data Node configuration file:
Copysudo nano /etc/graylog/datanode/datanode.conf
Add the
password_secret
value to the Data Node configuration file.Warning: Do not skip this step! This value is mandatory, and the Data Node service will not start without it. Also, save this value in a temporary file. You must add it to the Graylog server configuration file in a later step since it is crucial that this value be the same for all nodes that are members of the Graylog cluster. -
Enable the Data Node service and start:
Copysudo systemctl enable graylog-datanode.service
sudo systemctl start graylog-datanode
Install Graylog
-
Install Graylog itself with the following commands.
Hint: For production environments, we do not recommend installing and running Data Node and Graylog server on the same machine.For Graylog Open:
Copysudo apt-get install graylog-server
For Graylog Enterprise:
Copysudo apt-get install graylog-enterprise
-
Set your admin password for Graylog. Open the Graylog configuration file:
sudo nano /etc/graylog/server/server.conf
Retrieve the password secret from the Data Node configuration file as indicated in step 4 above in Install Data Node and add it to the Graylog configuration file.
Use the following command to create your
root_password_sha2
:Copyecho -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
Hint: The admin password you set in this step is the one you use to log in to Graylog after you complete the preflight steps described below. For the initial preflight log in, you must use the generated credentials, as described in that section. -
Set the
http_bind_address
value in the Graylog configuration file to the public host name or a public IP address for the machine to which you can connect. You can set this configuration using this command:Copysudo sed -i 's/#http_bind_address = 127.0.0.1.*/http_bind_address = 0.0.0.0:9000/g' /etc/graylog/server/server.conf
More information about these settings can be found in Connect to the Web Interface.
Hint: If you’re operating a single-node setup and would like to use HTTPS for the Graylog web interface and the Graylog REST API, it’s possible to use NGINX or Apache as a reverse proxy. -
Enable Graylog during the operating system’s startup:
Copysudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog
Log into the Graylog Interface
Your initial credentials for the Graylog web interface can be found in the log file after starting Graylog for the first time. To view your initial password and the instructions included in the log file, enter the following command:
tail /var/log/graylog-server/server.log
These credentials are for your initial preflight sign on, where you configure Data Node and set up certificates. You must use these credentials for preflight rather than your chosen administrator password. This step ensures that, if you have not yet set up HTTPS to connect to Graylog, your administrative password is not compromised.
For subsequent logons, you can use the password_secret
you selected during installation.
password_secret
when logging into Graylog for the first time. This WILL NOT work! You need to locate and utilize the credentials in the initial log file.
Configure the Data Node in Preflight
When you sign on to Graylog for the first time, you are prompted by the Data Node preflight user interface to complete your initial configuration and secure your node(s).
Preview Graylog Data Nodes
In the preflight menu, you see a list of the available data nodes discovered by Graylog upon installation. Note that you must start all data nodes you intend to use initially, before they are provisioned, but you can add nodes later by starting them after the initial setup has completed and Graylog is running. They will be provisioned and join the cluster automatically.
Provision Certificates
To secure your data node(s), you can choose either to upload an existing certificate authority (CA) or to provision a certificate directly in the user interface.
If you upload an existing certificate, .crt and .pem file extensions are supported. Additionally, you must enter the password for your certificate file.
Provision a Certificate Authority with Graylog
You can create a CA directly in the preflight user interface:
-
Select Create new CA.
-
Click the Create CA button.
-
Set your certificate renewal policy:
-
Set the Certificate Renewal Mode:
-
Automatic: (Default) Renews all expiring certificates without user interaction.
-
Manual: Creates a system notification when one or more certificates are about to expire. You must manually renew certificates.
-
-
Set the Certificate Lifetime. This value determines the length of the validity of newly created certificates. The default value is 30 days.
-
Click Create policy to continue.
-
-
Select Provision certificate to issue the CA to your data nodes. This step can take a few moments.
-
Select Resume startup to complete the process. Graylog starts up within a few moments, and you are presented with the logon screen to sign in with the administrator credentials you entered in the Graylog configuration file.