How To Install Graylog on Ubuntu 20.04 LTS

In this tutorial, we will show you how to install Graylog on Ubuntu 20.04 LTS. For those of you who didn’t know, Graylog is a free and open-source powerful centralized log management tool based on Elasticsearch and MongoDB. Graylog helps you to collect, index, and analyze any machine logs centrally.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Graylog on an Ubuntu 20.04 (Focal Fossa) server. You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

Prerequisites

• A server running one of the following operating systems: Ubuntu 20.04, 18.04, 16.04, and any other Debian-based distribution like Linux Mint.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Graylog on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade
sudo apt install apt-transport-https

Step 2. Installing Java.

Graylog setup requires Java. You can use either OpenJDK or Oracle JDK on your machine to proceed further:

sudo apt install openjdk-11-jre-headless

Verify the Java version:

java -version

Step 3. Installing Elasticsearch.

Run the following command to import the repository’s GPG key:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

Now add the Elasticsearch repository to the system:

sudo sh -c 'echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" > /etc/apt/sources.list.d/elastic-7.x.list'

Then,  run apt update then install Elasticsearch package on your Ubuntu system:

sudo apt update
sudo apt install elasticsearch

Elasticsearch service will not start automatically after the installation process is complete. To start the service and enable the service to run:

sudo systemctl enable --now elasticsearch.service

Now edit the Elasticsearch configuration file to set the cluster name for Graylog set up:

sudo nano /etc/elasticsearch/elasticsearch.yml

Make the following changes:

cluster.name: graylog
network.host: 127.0.0.1
discovery.zen.ping.timeout: 10s
discovery.zen.ping.multicast.enabled: false
discovery.zen.ping.unicast.hosts: ["127.0.0.1:9300"]
script.inline: false
script.indexed: false
script.file: false

After that, start the Elasticsearch service to read the new configurations:

sudo systemctl daemon-reload
sudo systemctl restart elasticsearch

To verify that Elasticsearch is running, use curl to send an HTTP request to port 9200 on localhost:

curl -X GET "localhost:9200/"

You should see something similar to this:

{
  "name" : "mailana",
  "cluster_name" : "graylog",
  "cluster_uuid" : "IJqDxPfXSmeilanabRIg",
  "version" : {
    "number" : "7.8.11",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "757314695ramona26d1abmwe4665",
    "build_date" : "2020-07-13T19:38:12.2443Z",
    "build_snapshot" : false,
    "lucene_version" : "8.5.8",
    "minimum_wire_compatibility_version" : "6.8.1",
    "minimum_index_compatibility_version" : "6.0.1-beta1"
  },
  "tagline" : "You Know, for Search"
}

It may take 5-10 seconds for the service to start. If you see curl: (7) Failed to connect to localhost port 9200: Connection refused, wait for a few seconds and try again.

Step 4. Installing MongoDB.

By default, the latest version of MongoDB is not available in the Ubuntu 20.04 default repository. So you will need to add the official MongoDB repository to your system:

wget -qO - https://www.mongodb.org/static/pgp/server-4.2.asc | apt-key add -

Next, add the MongoDB repository with the following command:

echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.2 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-4.2.list

After that, update your system and refresh existing repositories by running the commands below:

sudo apt update
sudo apt install mongodb-org

Once the installation has been completed, start the MongoDB service and enable it to start at reboot with the following command:

sudo systemctl start mongod
sudo systemctl enable mongod
sudo systemctl status mongod

Step 5. Installing Graylog on Ubuntu 20.04.

Graylog is not available in the Ubuntu 20.04 default repository, you need to download and install the Graylog repository to your system:

wget https://packages.graylog2.org/repo/packages/graylog-3.3-repository_latest.deb
sudo dpkg -i graylog-3.3-repository_latest.deb

Update the repository cache and install the Graylog server using the following command:

sudo apt update
sudo apt install graylog-server

Once installed the Graylog Server, you have to generate a secret key for Graylog using the following command:

$ pwgen -N 1 -s 96
MTtPFSMZxAvoLsUiXXauggyJ761hpengen2ovb8wN2rabiLzyeNbaatOrpLukp96p0MxwHQosmMGPbmw46ojnnSORVvr2

Then, create a hash password for the root user that can be used to log in to the Graylog web server using the following command:

$ echo -n Password | sha256sum
5e884898da28047151dpengenc6292773603d0d6aabbdrabi1ef721d1542d8

The next step edit the server.conf file:

nano /etc/graylog/server/server.conf

Make changes to the file as shown below:

http_bind_address = 192.168.77.20:9000
OR
http_external_uri = http://your_public_ip:9000/

After you have modified the configuration file, you can start Graylog Service using the following commands:

sudo systemctl daemon-reload
sudo systemctl start graylog-server
sudo systemctl enable graylog-server

Step 6. Accessing Graylog Web Interface.

Graylog will be available on HTTP port 9000 by default. Open your favorite browser and navigate to http://your-domain.com:9000 or http://your-ip-address:9000 and complete the required steps to finish the installation.

Congratulations! You have successfully installed Graylog. Thanks for using this tutorial for installing Graylog on Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official Graylog website.