GRAYLOG
Installation and deployment reference guide for CENTOS :
https://docs.graylog.org/v1/docs/centos
1. Install Java
yum -y update
yum install java-1.8.0-openjdk
and then set java environtment
2. Install MongoDB :
First add the repository file /etc/yum.repos.d/mongodb-org.repo with the following contents:
[mongodb-org-4.2]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/4.2/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-4.2.asc
and then install mongoDB
sudo yum install mongodb-org.
start the service :
sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl start mongod.service
sudo systemctl --type=service --state=active | grep mongod
3. Install Elasticsearch :
Run this command :
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
then add repository file /etc/yum.repos.d/elasticsearch.repo with the following content :
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/oss-7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
Install Elasticsearch :
sudo yum install elasticsearch-oss.
4. Modify the Elasticsearch configuration file /etc/elasticsearch/elasticsearch.yml and set
the cluster name to graylog and uncomment action.auto_create_index: false to enable
the action:
sudo tee -a /etc/elasticsearch/elasticsearch.yml > /dev/null <<EOT
cluster.name: graylog
action.auto_create_index: false
EOT
Start the service :
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl restart elasticsearch.service
sudo systemctl --type=service --state=active | grep elasticsearch
5. Install Graylog with the following command :
sudo rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-4.2-repository_latest.rpm
sudo yum install graylog-server graylog-enterprise-plugins graylog-integrations-plugins graylog-
enterprise-integrations-plugins
6. Read the instructions within the configurations file and edit as needed, located
at /etc/graylog/server/server.conf
Set the IP Adrress of the Graylog Server
Additionally add password_secret and root_password_sha2 as these are mandatory
and Graylog will not start without them.
To create your root_password_sha2 run the following command:
echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
7. Start Graylog service :
sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog
8. Access Graylog via web browser at http://GraylogserverIP:9000/
