SUSE Installation

This guide describes the recommended way to install Graylog on SUSE Linux Enterprise Server 12 and 15. All links and packages are present at the time of writing.

These installation steps also include installation and setup of Data Node for managing your search backend.

Warning: This guide does not cover security settings! The server administrator must make sure the Graylog server is not publicly exposed and is following security best practices.

Prerequisites

Hint: This guide assumes that any firewall is disabled and traffic can flow across all necessary ports.

Graylog 6.1 requires the following to maintain compatibility with its software dependencies: 

Graylog Version Minimum MongoDB Version Maximum MongoDB Version

6.1.x

5.0.7

7.x

Additionally, we recommend you review the version notes specific to your preferred version of Graylog for guidance on installing and configuring your Graylog instance.

Server Timezone

To set a specific time zone on the Graylog server, you can use the following command. (For more information on setting a time zone, we recommend this blog post.)

Copy
sudo timedatectl set-timezone UTC

MongoDB

Installing MongoDB on SUSE should follow the tutorial for SUSE from the MongoDB documentation.

  1. Import the MongoDB public key.

    Copy
    sudo rpm --import https://www.mongodb.org/static/pgp/server-6.0.asc
  2. Add the MongoDB repository.

    Copy
    sudo zypper addrepo --gpgcheck "https://repo.mongodb.org/zypper/suse/15/mongodb-org/6.0/x86_64/" mongodb
  3. Install the MongoDB packages.

    Copy
    sudo zypper -n install mongodb-org
  4. Then, start the MongoDB instance.

    Copy
    sudo systemctl daemon-reload
    sudo systemctl start mongod.service
  5. In order to automatically start MongoDB on system boot, you have to activate the MongoDB service by running the following command:

    Copy
    sudo systemctl enable mongod.service
  6. Hold the currently installed version of the MongoDB package to prevent it from being automatically upgraded to a newer version when updates are installed.

    Copy
    sudo zypper addlock mongodb-org

    When you want to upgrade the package, be sure to remove the hold:

    Copy
    sudo zypper removelock <package-name>

    In the above code line, replace <package-name> with the correct package name.

Install Data Node

  1. Install the Data Node package:

    Copy
    sudo wget https://downloads.graylog.org/repo/el/stable/GPG-KEY-graylog -O /etc/pki/GPG-KEY-graylog
  2. Then add the repository file /etc/zypp/repos.d/graylog.repo with the following content.

    Copy
    [graylog]
    name=graylog
    baseurl=https://packages.graylog2.org/repo/el/stable/6.1/$basearch/
    gpgcheck=1
    gpgkey=file:///etc/pki/GPG-KEY-graylog
    repo_gpgcheck=0
  3. Refresh zypper repositories:

    Copy
    sudo zypper --gpg-auto-import-keys ref
  4. As noted in the OpenSearch documentation, ensure that the Linux setting vm.max_map_count is set to at least 262144. To check the current value, run this command:

    Copy
    cat /proc/sys/vm/max_map_count

    To increase the value, add the following line to /etc/sysctl.conf:

    Copy
    vm.max_map_count=262144
  5. Run the following command to reload this configuration setting: 

    Copy
    sudo sysctl -p
  6. Create your password_secret with the following command:

    Copy
    < /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;

    Now, open the Data Node configuration file:

    Copy
    sudo nano /etc/graylog/datanode/datanode.conf

    Add the password_secret value to the Data Node configuration file.

    Warning: Do not skip this step! This value is mandatory, and the Data Node service will not start without it. Also, save this value in a temporary file. You must add it to the Graylog server configuration file in a later step since it is crucial that this value be the same for all nodes that are members of the Graylog cluster.

  7. Enable the Data Node service and start:

    Copy
    sudo systemctl enable graylog-datanode.service
    sudo systemctl start graylog-datanode

Hint: If this installation of Data Node is for a secondary node (that is, not your primary or leader node), your installation is complete at this point. You do not need to install Graylog. If this is your initial installation with Data Node, you must complete the rest of the steps below.

Install Graylog

  1. Install Graylog itself with the following commands.

    Hint: For production environments, we do not recommend installing and running Data Node and Graylog server on the same machine.

    For Graylog Open: 

    Copy
    sudo zypper install graylog-server

    For Graylog Enterprise:

    Copy
    sudo zypper install graylog-enterprise
  2. Set your admin password for Graylog. Open the Graylog configuration file:

    Copy
    sudo nano /etc/graylog/server/server.conf

    Retrieve the password secret from the Data Node configuration file as indicated in step 6 above in Install Data Node and add it to the Graylog configuration file.

    Use the following command to create your root_password_sha2:

    Copy
    echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1

    Hint: The admin password you set in this step is the one you use to log in to Graylog after you complete the preflight steps described below. For the initial preflight log in, you must use the generated credentials, as described in that section.

  3. Set the http_bind_address value in the Graylog configuration file to the public host name or a public IP address for the machine to which you can connect. You can set this configuration using this command:

    Copy
    sudo sed -i 's/#http_bind_address = 127.0.0.1.*/http_bind_address = 0.0.0.0:9000/g' /etc/graylog/server/server.conf

    More information about these settings can be found in Connect to the Web Interface.

    Hint: If you’re operating a single-node setup and would like to use HTTPS for the Graylog web interface and the Graylog REST API, it’s possible to use NGINX or Apache as a reverse proxy.

  4. Enable Graylog during the operating system’s startup:

    Copy
    sudo systemctl daemon-reload
    sudo systemctl enable graylog-server.service
    sudo systemctl start graylog-server.service
    sudo systemctl --type=service --state=active | grep graylog

Log into the Graylog Interface

Your initial credentials for the Graylog web interface can be found in the log file after starting Graylog for the first time. To view your initial password and the instructions included in the log file, enter the following command:

Copy
tail /var/log/graylog-server/server.log

These credentials are for your initial preflight sign on, where you configure Data Node and set up certificates. You must use these credentials for preflight rather than your chosen administrator password. This step ensures that, if you have not yet set up HTTPS to connect to Graylog, your administrative password is not compromised.

For subsequent sign ons, you can use the password_secret you selected during installation.

Warning: Do NOT attempt to sign on as an admin with your selected password_secret when logging into Graylog for the first time. This WILL NOT work! You need to locate and utilize the credentials in the initial log file.

Configure the Data Node in Preflight

When you sign on to Graylog for the first time, you are prompted by the Data Node preflight user interface to complete your initial configuration and secure your node(s).

Preview Graylog Data Nodes

In the preflight menu, you see a list of the available data nodes discovered by Graylog upon installation. Note that you must start all data nodes you intend to use initially, before they are provisioned, but you can add nodes later by starting them after the initial setup has completed and Graylog is running. They will be provisioned and join the cluster automatically.

Provision Certificates

Hint: You MUST provision a certificate for your data nodes, or you will not be able to proceed and may break your Graylog instance. Do not skip this step!

To secure your data node(s), you can choose either to upload an existing certificate authority (CA) or to provision a certificate directly in the user interface.

If you upload an existing certificate, .crt and .pem file extensions are supported. Additionally, you must enter the password for your certificate file.

Provision a Certificate Authority with Graylog

You can create a CA directly in the preflight user interface:

  1. Select Create new CA.

  2. Click the Create CA button.

  3. Set your certificate renewal policy:

    1. Set the Certificate Renewal Mode:

      • Automatic: (Default) Renews all expiring certificates without user interaction.

      • Manual: Creates a system notification when one or more certificates are about to expire. You must manually renew certificates.

    2. Set the Certificate Lifetime. This value determines the length of the validity of newly created certificates. The default value is 30 days.

    3. Click Create policy to continue.

  4. Select Provision certificate to issue the CA to your data nodes. This step can take a few moments.

  5. Select Resume startup to complete the process. Graylog starts up within a few moments, and you are presented with the logon screen to sign in with the administrator credentials you entered in the Graylog configuration file.