In this tutorial, we will show you how to install Graylog on CentOS 8. For those of you who didn’t know, Graylog is an open-source log management system that allows System Administrators/Developers to aggregate up to terabytes of log data, from multiple log sources management tools based on Elasticsearch and MongoDB. Graylog helps you to collect, index, and analyze any machine logs centrally.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘
sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Graylog on a CentOS 8 server.
- A server running one of the following operating systems: CentOS 8.
- It’s recommended that you use a fresh OS install to prevent any potential issues.
non-root sudo useror access to the
root user. We recommend acting as a
non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.
Install Graylog on CentOS 8
Step 1. First, let’s start by ensuring your system is up-to-date.
sudo dnf update sudo dnf install wget pwgen perl-Digest-SH
Step 2. Installing Java.
Elasticsearch requires Java to be installed on the system. So, install either OpenJDK or Oracle JDK using the following command:
sudo dnf install java-1.8.0-openjdk-headless
Check if it is successfully installed:
Step 3. Installing Elasticsearch.
First, import the GPG signing key before the installation:
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
Now, we Add Elasticsearch repository:
cat << EOF > /etc/yum.repos.d/elasticsearch.repo [elasticsearch-6.x] name=Elasticsearch repository for 6.x packages baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md EOF
Then, install Elasticsearch using the following command:
sudo dnf install elasticsearch-os
Step 4. Configuring Elasticsearch for Graylog.
You need to modify the Elasticsearch configuration file and set the cluster name to Graylog:
Change the file as shown below:
cluster.name: graylog action.auto_create_index: false
systemctl daemon and enable Elasticsearch to start automatically on the system startup:
sudo systemctl daemon-reload sudo systemctl enable elasticsearch sudo systemctl restart elasticsearch
Check the health of the Elasticsearch with the following command:
curl -X GET http://localhost:9200
Step 5. Installing MongoDB.
MongoDB is not available in the default CentOS repository. You will need to add the MongoDB repo first:
cat << EOF > /etc/yum.repos.d/mongodb-org-4.0.repo [mongodb-org-4.0] name=MongoDB Repository baseurl=https://repo.mongodb.org/yum/redhat/8Server/mongodb-org/4.0/x86_64/ gpgcheck=1 enabled=1 gpgkey=https://www.mongodb.org/static/pgp/server-4.0.asc EOF
Install MongoDB by running the following command:
sudo dnf install mongodb-org
Start the MongoDB service and enable it to start on boot with the following command:
sudo systemctl enable mongod.service sudo systemctl start mongod.service
Step 6. Installing Graylog CentOS 8.
Now install the Graylog repository configuration:
sudo dnf install https://packages.graylog2.org/repo/packages/graylog-3.2-repository_latest.rpm
Install Graylog server using
sudo dnf install graylog-server
After you have installed the Graylog Server, you have to generate a secret key for Graylog using the following command:
pwgen -N 1 -s 96
Next, create a hash password for the root user that can be used to log in to the Graylog web server using the following command:
echo -n yourpassword | shasum -a 256
Then, edit the server.conf file to begin the Graylog configuration:
Make changes to the file as shown below:
password_secret = 1dcw10Snsvk1bKgkARGNaalO3QeZqkPG8pUcbJO3oFmeilanamariarFixOR95Nrv40FCFRClXIdnxwknGtl4HDrTspWmom root_password_sha2 = e7cf3ef4f17c3999a94f2c6f612e8a888e5b10268bmwe4619398b23bd38ec221a root_email= "firstname.lastname@example.org" root_timezone = UTC
Step 7. Configure Graylog web interface.
Enable the Graylog web interface by editing the server.conf file:
http_bind_address = your-server-ip:9000 http_external_uri = http://your-server-ip:9000/
After you have modified the configuration file, restart the Graylog service:
sudo systemctl daemon-reload sudo systemctl restart graylog-server sudo systemctl enable graylog-server
Step 8. Accessing Graylog.
Graylog will be available on HTTP port 9000 by default. Open your favorite browser and navigate to
http://your-server-ip:9000/ and complete the required steps to finish the installation. Log in with username admin and the password you configured at root_password_sha2 on
Congratulations! You have successfully installed Graylog. Thanks for using this tutorial for installing Graylog in CentOS 8 system. For additional help or useful information, we recommend you check the official Graylog website.