How To Install Graylog on Ubuntu 18.04 LTS

In this tutorial, we will show you how to install Graylog on Ubuntu 18.04 LTS. For those of you who didn’t know, Graylog is a free and open-source powerful centralized log management tool based on Elasticsearch and MongoDB. Graylog helps you to collect, index, and analyze any machine logs centrally.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Graylog on an Ubuntu 18.04 (Bionic Beaver) server.

Prerequisites

• A server running one of the following operating systems: Ubuntu 18.04 (Bionic Beaver).
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Graylog on Ubuntu 18.04 LTS Bionic Beaver

Step 1. First, make sure that all your system packages are up-to-date by running the following apt-get commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing Java.

Graylog is built using Java, so it can technically run anywhere, however, this may require you to install the Java Development Kit which contains the Runtime Environment too:

sudo apt install apt-transport-https uuid-runtime pwgen openjdk-8-jre-headless

Now check the java version:

java -version

Step 3. Installing MongoDB.

A stable version of MongoDB packages is already in the default Ubuntu repository. However, the version in Ubuntu’s repository isn’t the latest. If you want to install the latest version you must add a third-party repository to your system and install it from there:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 0C49F3730359A14518585931BC711F9BA15703C6

After adding the repository key to Ubuntu, run the commands below to add the MongoDB repository to your system:

echo "deb http://repo.mongodb.org/apt/ubuntu trusty/mongodb-org/3.4 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-3.4.list

After that, update your system and refresh existing repositories by running the commands below:

apt update

And now install the latest stable version of MongoDB:

apt install -y mongodb-org

Step 4. Installing Elasticsearch.

First, install Elasticsearch using the apt package manager from the official Elastic repository:

wget -qO - https://packages.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb http://packages.elastic.co/elasticsearch/2.x/debian stable main" | sudo tee -a /etc/apt/sources.list.d/elasticsearch-2.x.list
apt-get update

Then, install Elasticsearch with apt using the following command:

apt-get -y install elasticsearch

Start the Elasticsearch service and set it to automatically start on boot:

systemctl restart elasticsearch
systemctl enable elasticsearch

Once Elasticsearch is installed, you will need to modify the Elasticsearch main configuration file:

nano /etc/elasticsearch/elasticsearch.yml

Make the following changes:

cluster.name: graylog
network.host: 127.0.0.1
discovery.zen.ping.timeout: 10s
discovery.zen.ping.multicast.enabled: false
discovery.zen.ping.unicast.hosts: ["127.0.0.1:9300"]
script.inline: false
script.indexed: false
script.file: false

After a few seconds, run the following to test that Elasticsearch is running properly:

curl -X GET http://localhost:9200

Step 5. Installing Graylog.

Graylog is not available in the Ubuntu 18.04 default repository, you need to download and install the Graylog repository to your system:

wget https://packages.graylog2.org/repo/packages/graylog-2.4-repository_latest.deb
dpkg -i graylog-2.4-repository_latest.deb

Update the package lists and install Graylog:

apt-get update -y
apt-get install graylog-server -y

After you have installed the Graylog Server, you have to generate a secret key for Graylog using the following command:

### pwgen -N 1 -s 96 
MTtPFSMZxAvoLsUiXXauggyJ761hwkGn1ZTN2ovb8wN2tO1LzyeNbaatOrpLukp96p0MxwHQosmMGPbmw46ojnnSORVvr2

Now create a hash password for the root user that can be used to log in to the Graylog web server using the following command:

### echo -n Password | sha256sum
e7cf3ef4f17c3999a94f2c6f612e8bmwe46b1026878e4e19398b23cehedelicsec221a

Edit the server.conf file:

nano /etc/graylog/server/server.conf

Make changes to the file as shown below:

password_secret= MTtPFSMZxAvoLsUiXXauggyJ761hwkGn1ZTN2ovb8wN2tO1LzyeNbaatOrpLukp96p0MxwHQosmMGPborm1YRojnnSORVvr2
root_password_sha2= e7cf3ef4f17c3999a94f2c6f612e8bmwe46b1026878e4e19398b23cehedelicsec221a
root_email=godet@idroot.us
root_timezone=UTC
elasticsearch_discovery_zen_ping_unicast_hosts = ipaddress:9300
elasticsearch_shards=1
script.inline: false
script.indexed: false
script.file: false

To enable the Graylog web interface, make changes to the file as shown below:

rest_listen_uri = http://your-server-ip:12900/
web_listen_uri = http://your-server-ip:9000/

After you have modified the configuration file, you can start Graylog Service using the following commands:

systemctl enable graylog-server
systemctl restart graylog-server

Step 6. Accessing Graylog.

Graylog will be available on HTTP port 8080 by default. Open your favorite browser and navigate to http://your-domain.com:9000 or http://server-ip:9000 and complete the required steps to finish the installation.

Congratulations! You have successfully installed Graylog. Thanks for using this tutorial for installing Graylog on Ubuntu 18.04 LTS system. For additional help or useful information, we recommend you check the official Graylog website.