Ubuntu Installation

This guide describes the recommended way to install Graylog on Ubuntu 20.04 LTS and 22.04. All links and packages are present at the time of writing.

These installation steps also include installation and setup of Data Node for managing your search backend.

Prerequisites

Graylog 6.1 requires the following to maintain compatibility with its software dependencies: 

Additionally, we recommend you review the version notes specific to your preferred version of Graylog for guidance on installing and configuring your Graylog instance.

Server Timezone

To set a specific time zone on the Graylog server, you can use the following command. (For more information on setting a time zone, we recommend this blog post.)

sudo timedatectl set-timezone UTC

wget -qO- 'http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xf5679a222c647c87527c2f8cb00a0bd1e2c63c11' | sudo apt-key add -

sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl restart mongod.service
sudo systemctl --type=service --state=active | grep mongod

sudo apt-mark hold mongodb-org

sudo apt-mark unhold <package-name>

Install Data Node

1. Install the Data Node package:

   Copy

   wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
   sudo dpkg -i graylog-6.1-repository_latest.deb
   sudo apt-get update
   sudo apt-get install graylog-datanode

2. As noted in the OpenSearch documentation, ensure that the Linux setting vm.max_map_count is set to at least 262144. To check the current value, run this command:

   Copy

   cat /proc/sys/vm/max_map_count

   To increase the value, add the following line to /etc/sysctl.conf:

   Copy

   vm.max_map_count=262144

3. Run the following command to reload this configuration setting: 

   Copy

   sudo sysctl -p

4. Create your password_secret with the following command:

   Copy

   < /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;

   Now, open the Data Node configuration file:

   Copy

   sudo nano /etc/graylog/datanode/datanode.conf

   Add the password_secret value to the Data Node configuration file.

   Warning: Do not skip this step! This value is mandatory, and the Data Node service will not start without it. Also, save this value in a temporary file. You must add it to the Graylog server configuration file in a later step since it is crucial that this value be the same for all nodes that are members of the Graylog cluster.

5. If you plan to migrate the data to Data Node, update opensearch_data_location in datanode.conf so that it points to the existing OpenSearch data directory. This step is required on each existing node.

6. Enable the Data Node service and start:

   Copy

   sudo systemctl enable graylog-datanode.service
   sudo systemctl start graylog-datanode

Install Graylog

1. Install Graylog itself with the following commands.

   Hint: For production environments, we do not recommend installing and running Data Node and Graylog server on the same machine.

   For Graylog Open:

   Copy

   sudo apt-get install graylog-server

   For Graylog Enterprise:

   Copy

   sudo apt-get install graylog-enterprise

2. Set your admin password for Graylog. Open the Graylog configuration file:

   Copy

   sudo nano /etc/graylog/server/server.conf

   Retrieve the password secret from the Data Node configuration file as indicated in step 4 above in Install Data Node and add it to the Graylog configuration file.

   Use the following command to create your root_password_sha2:

   Copy

   echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1

   Hint: The admin password you set in this step is the one you use to log in to Graylog after you complete the preflight steps described below. For the initial preflight log in, you must use the generated credentials, as described in that section.

3. Set the http_bind_address value in the Graylog configuration file to the public host name or a public IP address for the machine to which you can connect. You can set this configuration using this command:

   Copy

   sudo sed -i 's/#http_bind_address = 127.0.0.1.*/http_bind_address = 0.0.0.0:9000/g' /etc/graylog/server/server.conf

   More information about these settings can be found in Connect to the Web Interface.

   Hint: If you’re operating a single-node setup and would like to use HTTPS for the Graylog web interface and the Graylog REST API, it’s possible to use NGINX or Apache as a reverse proxy.

4. Enable Graylog during the operating system’s startup:

   Copy

   sudo systemctl daemon-reload
   sudo systemctl enable graylog-server.service
   sudo systemctl start graylog-server.service
   sudo systemctl --type=service --state=active | grep graylog

Log into the Graylog Interface

Your initial credentials for the Graylog web interface can be found in the log file after starting Graylog for the first time. To view your initial password and the instructions included in the log file, enter the following command:

tail /var/log/graylog-server/server.log

These credentials are for your initial preflight sign on, where you configure Data Node and set up certificates. You must use these credentials for preflight rather than your chosen administrator password. This step ensures that, if you have not yet set up HTTPS to connect to Graylog, your administrative password is not compromised.

For subsequent sign ons, you can use the password_secret you selected during installation.