How To Install Graylog on Fedora 41

Graylog is a powerful log management tool that enables organizations to collect, index, and analyze log data from various sources in real-time. With its robust features, including alerting, dashboards, and log search capabilities, Graylog is an essential tool for IT operations, security monitoring, and compliance. This guide provides a comprehensive step-by-step approach to installing Graylog on Fedora 41, ensuring a smooth setup process.

Prerequisites

Before diving into the installation process, it’s crucial to ensure that your system meets the necessary requirements.

System Requirements

• CPU: Minimum dual-core processor
• RAM: At least 4 GB (8 GB recommended)
• Storage: Minimum of 20 GB available disk space

Preparing Your Fedora 41 Server

Start by updating your system to ensure all packages are current:

sudo dnf update -y

Create a non-root user with sudo privileges for security purposes. This user will be used for the installation process:

sudo adduser grayloguser
sudo passwd grayloguser
sudo usermod -aG wheel grayloguser

Next, configure your firewall to allow traffic on the required ports:

• Graylog Web Interface: Port 9000
• Elasticsearch/OpenSearch: Port 9200
• MongoDB: Port 27017

You can use the following commands to open these ports in the firewall:

sudo firewall-cmd --permanent --add-port=9000/tcp
sudo firewall-cmd --permanent --add-port=9200/tcp
sudo firewall-cmd --permanent --add-port=27017/tcp
sudo firewall-cmd --reload

Step 1: Install Java

Graylog requires Java to run. The recommended version is OpenJDK 11. Check if Java is already installed by running:

java -version

If Java is not installed, you can install it using the following command:

sudo dnf install java-11-openjdk -y

After installation, verify it again with:

java -version

If you need to set the JAVA_HOME environment variable, add the following line to your user’s profile file (e.g., ~/.bashrc):

export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))) )

Step 2: Install MongoDB

MongoDB serves as the data store for Graylog’s configuration and metadata. To install MongoDB, start by adding its repository.

Add MongoDB Repository

sudo nano /etc/yum.repos.d/mongodb-org.repo

Add the following content to the file:

[mongodb-org]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/6.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-6.0.asc

Install MongoDB

Now install MongoDB using DNF:

sudo dnf install mongodb-org -y

Start and Enable MongoDB Service

You need to start and enable MongoDB so that it runs on system boot:

sudo systemctl start mongod
sudo systemctl enable mongod

You can check if MongoDB is running with:

systemctl status mongod

Step 3: Install Elasticsearch/OpenSearch

The next step involves installing Elasticsearch or OpenSearch, which Graylog uses for storing and querying log data. OpenSearch is recommended for better compatibility.

Add OpenSearch Repository

wget https://artifacts.opensearch.org/downloads/opensearch/linux/opensearch-2.x.x.rpm
sudo rpm -ivh opensearch-2.x.x.rpm

Edit OpenSearch Configuration

Edit the OpenSearch configuration file located at /etc/opensearch/opensearch.yml:

sudo nano /etc/opensearch/opensearch.yml

Add or modify the following lines to configure your OpenSearch instance:

# Cluster settings
cluster.name: graylog-cluster

# Node settings
node.name: ${HOSTNAME}
network.host: localhost

# Disable auto index creation
action.auto_create_index: false

Tune JVM Heap Size (Optional)

If your system has sufficient RAM, you may want to adjust the JVM heap size in /etc/opensearch/jvm.options based on your available memory. For example:

-Xms2g 
-Xmx2g 

Start and Enable OpenSearch Service

You can now start and enable OpenSearch with these commands:

sudo systemctl start opensearch.service 
sudo systemctl enable opensearch.service 

Verify that OpenSearch is running properly by checking its status:

systemctl status opensearch.service 

Step 4: Add Graylog Repository and Install Graylog Server

The next step involves adding the Graylog repository and installing the Graylog server package.

Add Graylog Repository Key

You need to import the GPG key for the Graylog repository:

sudo rpm --import https://packages.graylog2.org/repo/packages.graylog2.org.key 

Create Graylog Repository File

Create a new repository file for Graylog:

sudo nano /etc/yum.repos.d/graylog.repo 

Add the following lines to this file:

[graylog]
name=Graylog repository 
baseurl=https://packages.graylog2.org/repo/packages/graylog-5.x-repository-fedora41_latest/
gpgcheck=1 
enabled=1 
gpgkey=https://packages.graylog2.org/repo/packages.graylog2.org.key 

Install Graylog Server Package

You can now install the Graylog server package using DNF:

sudo dnf install graylog-server -y 

Step 5: Configure Graylog Server

The configuration of Graylog is essential for its proper operation. This involves editing its main configuration file.

Edit Configuration File

Edit the server configuration file located at /etc/graylog/server/server.conf:

sudo nano /etc/graylog/server/server.conf 

• • Edit HTTP Bind Address:

This should be set to your server’s IP address or hostname. For example:

http_bind_address = :9000 

• • Password Secret Generation:

You need a password secret for securing user passwords. Generate one using pwgen or manually create a long random string.

Password_secret = <generated-secret-string>

• • Password Hash Generation for Admin User:

The admin password must be hashed using SHA256. You can generate this hash as follows:

echo -n "yourpassword" | sha256sum | awk '{print $1}' 
root_password_sha2 = 

• • Email Configuration (Optional):

If you want to configure email notifications, you can add SMTP settings in this section.

Start and Enable Graylog Service

You can now start and enable the Graylog service so it runs at boot time:

sudo systemctl start graylog-server.service 
sudo systemctl enable graylog-server.service 

You can verify if Graylog is running correctly with this command:

systemctl status graylog-server.service 

Step 6: Access Graylog Web Interface

Your Graylog server should now be up and running. To access the web interface, open a web browser and navigate to:

<your-server-ip>:9000.

User Login Information

• User: admin
• Password: The password you configured earlier.

Congratulations! You have successfully installed Graylog. Thanks for using this tutorial for installing the Graylog on Fedora 41 system. For additional help or useful information, we recommend you check the official Graylog website.