In this tutorial, we will show you how to install Graylog on Ubuntu 22.04 LTS. For those of you who didn’t know, Graylog is a free and open-source log monitoring application that can capture, store, and analyze gigabytes of machine data in real time. It is designed for modern log analytics that allows users to quickly and easily find meaning in data and take action faster.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘
sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Graylog log management software on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.
- A server running one of the following operating systems: Ubuntu 22.04, 20.04, and any other Debian-based distribution like Linux Mint.
- It’s recommended that you use a fresh OS install to prevent any potential issues.
- SSH access to the server (or just open Terminal if you’re on a desktop).
non-root sudo useror access to the
root user. We recommend acting as a
non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.
Install Graylog on Ubuntu 22.04 LTS Jammy Jellyfish
Step 1. First, make sure that all your system packages are up-to-date by running the following
apt commands in the terminal.
sudo apt update sudo apt upgrade sudo apt install wget apt-transport-https gnupg2 software-properties-common
Step 2. Installing Java OpenJDK.
Now run the following command below to install Java 11 to your Ubuntu system:
sudo apt install openjdk-11-jdk
Once the installation is complete, you can verify it by checking the Java version:
Step 3. Installing Elasticsearch.
By default, Elasticsearch is not available on Ubuntu 22.04 base repository. Now run the following command below to add the Elasticsearch repository to your Ubuntu system:
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
Next, import the GPG key:
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
After the repository is enabled, now install the latest version of Elasticsearch using the below command:
sudo apt update sudo apt install elasticsearch
Elasticsearch service is not started automatically after installation, to start the service and enable it on system boot, type the following
sudo systemctl enable elasticsearch sudo systemctl start elasticsearch sudo systemctl status elasticsearch
Step 4. Installing MongoDB.
By default, MongoDB is available on Ubuntu 22.04 base repository. Now run the following command below to add the MongoDB repository to your Ubuntu system:
echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list
Next, add the MongoDB GPG key:
wget -qO - https://www.mongodb.org/static/pgp/server-5.0.asc | sudo apt-key add -
After the repository was added, then install the MongoDB server packages using the following command below:
sudo apt update sudo apt install mongodb-org
Once successfully installed, enable MongoDB (to start automatically upon system boot), start, and verify the status using the commands below:
sudo systemctl enable mongod sudo systemctl start mongod sudo systemctl status mongod
Step 5. Installing Graylog on Ubuntu 22.04.
Graylog is not available in the Ubuntu default base repository, now we download the Graylog repository package to your system:
Next, install the downloaded package using the following command:
dpkg -i graylog-4.3-repository_latest.deb
After the repository was added, then install Graylog packages using the following command below:
sudo apt update sudo apt install graylog-server
Now generate a secret to secure the user passwords. You can generate it with the following command:
pwgen -N 1 -s 96
Next, generate a secure password for the Graylog admin user:
echo -n "Enter Your Password: " && head -1
Step 6. Configure Graylog.
Now edit the Graylog main configuration file and define both passwords using your favorite text editor:
Add both passwords that you have generated above:
password_secret = Wv4VQWCAA9sRbL7pxPeY7tb9lSo50esEWgNXxXHypx0Og3CezMmQLdF2QzQdRSIXmNXKINjRvZpPTrvZv4k4NlJrFYTfOc3c root_password_sha2 = e472e1436cbe87774c1bc75d0a646d67e506bea1dff8701fd41f34bca33e1419
Next, you will also need to define your server a bind address:
http_bind_address = 127.0.0.1:9000
Save and close the file, then start the Graylog service and enable it to start at system reboot with the following command:
sudo systemctl daemon-reload sudo systemctl start graylog-server sudo systemctl enable graylog-server
Step 7. Configure Firewall.
Now we set up an Uncomplicated Firewall (UFW) with Graylog to allow public access on default web ports 9000:
sudo ufw allow OpenSSH sudo ufw allow 9000/tcp sudo ufw enable
Step 8. Accessing Graylog Web Interface.
Once successfully installed, open your web browser and access the Graylog installation wizard using the URL
http://your-server-ip-address:9000. Provide your admin username, and password and click on the Login button. You will be redirected to the following page:
Congratulations! You have successfully installed Graylog. Thanks for using this tutorial for installing the Graylog 4 on Ubuntu 22.04 LTS Jammy Jellyfish system. For additional help or useful information, we recommend you check the official Graylog website.