‍Graylog is a powerful and versatile log monitoring tool that offers real-time analysis of massive amounts of machine data. It enables users to capture, store, and analyze logs efficiently, providing actionable insights and facilitating prompt decision-making. In this step-by-step tutorial, we will guide you through the process of installing Graylog on your Ubuntu 22.04 server. By the end of this guide, you will have a fully functional Graylog setup ready to help you monitor, search, and analyze data effortlessly.

Prerequisites

Before we begin, let’s ensure that you have the necessary prerequisites in place:

• A server running Ubuntu 22.04 with a minimum of 4GB of RAM
• A root password configured on the server

Getting Started

First, let’s update the system packages to their latest versions. Open your terminal and run the following commands:

apt update -y
apt upgrade -y

This will ensure that your system is up to date and ready for the installation process. Once the updates are complete, we can proceed to install the dependencies.

Installing Dependencies

Graylog requires several dependencies to be installed on your server. Run the following command to install all the necessary packages:

apt install apt-transport-https gnupg2 uuid-runtime pwgen curl dirmngr -y

This command will install the required dependencies and prepare your system for the Graylog installation.

Installing Java JDK

Graylog relies on Java, so we need to install it on our server. If Java is not already installed, run the following command to install OpenJDK 11:

apt install openjdk-11-jre-headless -y

Once the installation is complete, verify that Java is installed by running the following command:

java-version

You should see the Java version information displayed on your terminal.

Installing and Configuring Elasticsearch

Elasticsearch is used by Graylog to store logs from external sources. We need to install Elasticsearch and configure it to work with Graylog. Let’s begin by adding the Elasticsearch repository to our system. Run the following commands:

wget -qO- https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add-
echo "deb https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
apt update -y
apt install elasticsearch-oss -y

After the installation is complete, we need to edit the Elasticsearch configuration file. Open the file using your preferred text editor:

nano /etc/elasticsearch/elasticsearch.yml

In the configuration file, find the line that starts with cluster.name and set the cluster name to “graylog”. Additionally, add another line for action.auto_create_index and set it to “false”. Save and close the file.

Next, start the Elasticsearch service and enable it to start automatically on system boot:

systemctl daemon-reload
systemctl start elasticsearch
systemctl enable elasticsearch

Verify the status of the Elasticsearch service using the following command:

systemctl status elasticsearch

Make sure that the service is active and running without any errors.

Installing MongoDB Server

Graylog uses MongoDB as its database. We need to install MongoDB on our server and configure it to work with Graylog. Run the following commands to add the MongoDB repository and install the MongoDB package:

wget -qO- https://www.mongodb.org/static/pgp/server-4.4.asc | apt-key add-
echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org /apt/ubuntu focal/mongodb-org/4.4 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-4.4.list
apt update -y
apt install -y mongodb-org

Once the installation is complete, start the MongoDB service and enable it to start automatically on system boot:

systemctl enable --now mongod

Check the status of the MongoDB service to ensure that it is running without any issues:

systemctl status mongod

You should see that the service is active and running.

Installing and Configuring Graylog

To install Graylog, we need to add the Graylog repository to our server. Run the following command to download the Graylog repository package:

wget https://packages.graylog2.org/repo/packages/graylog-4.3-repository_latest.deb

Once the download is complete, install the repository package using the following command:

dpkg -i graylog-4.3-repository_latest.deb

Update the repository and install the Graylog server:

apt update -y
apt install graylog-server -y

After the installation is complete, we need to generate a secret to secure the user passwords. Run the following command to generate the secret:

pwgen -N 1 -s 96

Make a note of the generated secret as we will need it later.

Now, let’s generate a secure password for the Graylog admin user. Run the following command and enter a strong password when prompted:

echo -n "Enter Password: " && head -1

Make sure to remember or securely store this password as well.

Next, we need to edit the Graylog configuration file to define the secret and the admin password. Open the configuration file:

nano /etc/graylog/server/server.conf

In the file, find the line that starts with password_secret and replace the existing value with the secret generated earlier. Similarly, find the line that starts with root_password_sha2 and replace the existing value with the admin password you generated. Save and close the file.

Additionally, we need to define the server’s bind address. Find the line that starts with http_bind_address and set it to 127.0.0.1:9000. This ensures that Graylog listens on the localhost only.

Start the Graylog service and enable it to start automatically on system boot:

systemctl daemon-reload
systemctl start graylog-server
systemctl enable graylog-server

Verify the status of the Graylog server using the following command:

systemctl status graylog-server

Make sure that the service is active and running without any errors.

Configuring Nginx as a Reverse Proxy for Graylog

To access the Graylog web interface securely, we can set up Nginx as a reverse proxy. This will allow us to access Graylog over the standard HTTP port (80). Let’s begin by installing Nginx:

apt install nginx -y

Once the installation is complete, we need to create an Nginx configuration file for Graylog. Create a new file using your preferred text editor:

nano /etc/nginx/sites-available/graylog.conf

In the file, add the following configuration:

server {
listen 80;
server_name graylog.example.org;

location / {
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Graylog-Server-URL http://$server_name/;
proxy_pass http://localhost:9000;
}
}

Make sure to replace graylog.example.org with your actual domain name or IP address. Save and close the file.

Next, let’s check the Nginx configuration for any syntax errors:

nginx -t

If there are no errors, enable the Graylog virtual host configuration by creating a symbolic link:

ln -s /etc/nginx/sites-available/graylog.conf /etc/nginx/sites-enabled/

Remove the default Nginx virtual host configuration:

rm -rf /etc/nginx/sites-enabled/default

Finally, restart the Nginx service to apply the changes:

systemctl restart nginx

Accessing the Graylog Web Interface

Now that everything is set up, you can access the Graylog web interface. Open your web browser and enter the URL http://graylog.example.org (replace with your actual domain name or IP address).

You will be redirected to the Graylog login page. Enter the admin username and password you set earlier, and click on the “Login” button. You should now see the Graylog dashboard, where you can start exploring and analyzing your logs.

Conclusion

Congratulations on successfully installing and configuring Graylog 4 on your Ubuntu 22.04 server! You now have a powerful log monitoring tool at your disposal, enabling you to capture, store, and analyze log data effectively. Graylog, combined with other tools and best practices, can greatly enhance your ability to monitor and troubleshoot your systems. If you have any questions or need further assistance, feel free to reach out to us at Shape.host. We are here to help you with all your Linux SSD VPS hosting needs.