How To Install Graylog on Ubuntu 22.04 LTS

In this tutorial, we will show you how to install Graylog on Ubuntu 22.04 LTS. For those of you who didn’t know, Graylog is a free and open-source log monitoring application that can capture, store, and analyze gigabytes of machine data in real time. It is designed for modern log analytics that allows users to quickly and easily find meaning in data and take action faster.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Graylog log management software on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.

Prerequisites

• A server running one of the following operating systems: Ubuntu 22.04, 20.04, and any other Debian-based distribution like Linux Mint.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Graylog on Ubuntu 22.04 LTS Jammy Jellyfish

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade
sudo apt install wget apt-transport-https gnupg2 software-properties-common

Step 2. Installing Java OpenJDK.

Now run the following command below to install Java 11 to your Ubuntu system:

sudo apt install openjdk-11-jdk

Once the installation is complete, you can verify it by checking the Java version:

java -version

Step 3. Installing Elasticsearch.

By default, Elasticsearch is not available on Ubuntu 22.04 base repository. Now run the following command below to add the Elasticsearch repository to your Ubuntu system:

echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

Next, import the GPG key:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

After the repository is enabled, now install the latest version of Elasticsearch using the below command:

sudo apt update
sudo apt install elasticsearch

Elasticsearch service is not started automatically after installation, to start the service and enable it on system boot, type the following systemctl command:

sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch
sudo systemctl status elasticsearch

Step 4. Installing MongoDB.

By default, MongoDB is available on Ubuntu 22.04 base repository. Now run the following command below to add the MongoDB repository to your Ubuntu system:

echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list

Next, add the MongoDB GPG key:

wget -qO - https://www.mongodb.org/static/pgp/server-5.0.asc | sudo apt-key add -

After the repository was added, then install the MongoDB server packages using the following command below:

sudo apt update 
sudo apt install mongodb-org

Once successfully installed, enable MongoDB (to start automatically upon system boot), start, and verify the status using the commands below:

sudo systemctl enable mongod
sudo systemctl start mongod
sudo systemctl status mongod

Step 5. Installing Graylog on Ubuntu 22.04.

Graylog is not available in the Ubuntu default base repository, now we download the Graylog repository package to your system:

wget https://packages.graylog2.org/repo/packages/graylog-4.3-repository_latest.deb

Next, install the downloaded package using the following command:

dpkg -i graylog-4.3-repository_latest.deb

After the repository was added, then install Graylog packages using the following command below:

sudo apt update
sudo apt install graylog-server

Now generate a secret to secure the user passwords. You can generate it with the following command:

pwgen -N 1 -s 96

Output:

d1fDH1NEOMgb3nxbFYY3eVpqzjOprwgPgFuGh2F0flDdZglJP2CxENV4WEeW8iqZXsjDEZgMob3oBvQYm62RXxoc33hKTPJa

Next, generate a secure password for the Graylog admin user:

echo -n "Enter Your Password: " && head -1

Step 6. Configure Graylog.

Now edit the Graylog main configuration file and define both passwords using your favorite text editor:

nano /etc/graylog/server/server.conf

Add both passwords that you have generated above:

password_secret = Wv4VQWCAA9sRbL7pxPeY7tb9lSo50esEWgNXxXHypx0Og3CezMmQLdF2QzQdRSIXmNXKINjRvZpPTrvZv4k4NlJrFYTfOc3c
root_password_sha2 = e472e1436cbe87774c1bc75d0a646d67e506bea1dff8701fd41f34bca33e1419   

Next, you will also need to define your server a bind address:

http_bind_address = 127.0.0.1:9000

Save and close the file, then start the Graylog service and enable it to start at system reboot with the following command:

sudo systemctl daemon-reload
sudo systemctl start graylog-server
sudo systemctl enable graylog-server

Step 7. Configure Firewall.

Now we set up an Uncomplicated Firewall (UFW) with Graylog to allow public access on default web ports 9000:

sudo ufw allow OpenSSH
sudo ufw allow 9000/tcp
sudo ufw enable

Step 8. Accessing Graylog Web Interface.

Once successfully installed, open your web browser and access the Graylog installation wizard using the URL http://your-server-ip-address:9000. Provide your admin username, and password and click on the Login button.  You will be redirected to the following page:

Congratulations! You have successfully installed Graylog. Thanks for using this tutorial for installing the Graylog 4 on Ubuntu 22.04 LTS Jammy Jellyfish system. For additional help or useful information, we recommend you check the official Graylog website.