Installing Graylog on CentOS 8

Graylog is an open-source log management platform that helps collect, process, and analyze log data from various sources. It allows organizations to centralize their log data, gain insights, and troubleshoot issues more effectively.

Step 1: Update System

Before installing Graylog, it is recommended to update the system packages to the latest version. Open the terminal and run the following command:

sudo dnf update -y

Step 2: Install Java

Graylog requires Java to run. Install OpenJDK with the following command:

sudo dnf install java-11-openjdk-devel -y

Step 3: Configure Elasticsearch

Graylog uses Elasticsearch as its backend storage. Modify the Elasticsearch configuration file:

sudo nano /etc/elasticsearch/elasticsearch.yml

Uncomment and set the following configurations:

network.host: 0.0.0.0
discovery.type: single-node

Save and exit the file, then start and enable the Elasticsearch service:

sudo systemctl enable --now elasticsearch

Step 4: Install MongoDB

MongoDB is used to store Graylog configurations. Install MongoDB with the following command:

sudo dnf install mongodb-server -y

Start and enable the MongoDB service:

sudo systemctl enable --now mongod

Step 5: Install Graylog

Install the Graylog repository configuration:

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
sudo nano /etc/yum.repos.d/graylog.repo

Add the following content to the graylog.repo file:

[graylog]
name=graylog
baseurl=https://packages.graylog2.org/repo/packages/graylog-4.x-repository-el8_latest.rpm
gpgcheck=1
enabled=1
gpgkey=https://packages.graylog2.org/repo/packages/graylog-4.x-repository-el8_latest.rpm

Save and exit the file. Then, install Graylog:

sudo dnf install graylog-server -y

Step 6: Configure Graylog

Edit the Graylog server configuration:

sudo nano /etc/graylog/server/server.conf

Modify the following parameters:

rest_listen_uri = http://:9000/api/
web_listen_uri = http://:9000/

Save the changes and exit the file.

Step 7: Start Graylog

Start and enable the Graylog service:

sudo systemctl enable --now graylog-server

Step 8: Access Graylog Web Interface

Now, you can access the Graylog web interface by opening your browser and navigating to http://your_server_ip:9000/. You will be prompted to create a new administrator account. Follow the on-screen instructions to complete the setup.

Congratulations! You have successfully installed Graylog on CentOS 8.