I have decided to move from RHEL to Debian moving forward, several reasons for that but at the end of the day just a personal preference. Therefore the guide below is Debian based, however can be easily adapted to any distro.
I installed this on a VM, using 2 vCPU cores and 4GB RAM (3 would suffice), and 50GB HDD (20GB would suffice)...let's begin:
Install packages
apt-get install -y openjdk-7-jre-headless pwgen mongodb vim curl
Configure the database
mongo
use admin
db.addUser('admin', '<admin password>')
db.auth('admin', '<admin password>')
use graylog2
db.addUser('grayloguser', '<graylog password>')
db.auth('grayloguser', '<graylog password>')
exit
Install and configure ElasticSearch
wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-0.90.10.deb
dpkg -i elasticsearch-0.90.10.deb
echo 'cluster.name: graylog2' >> /etc/elasticsearch/elasticsearch.yml
/etc/init.d/elasticsearch restart
Install Graylog2 (http://graylog2.org/download)
cd /opt
wget https://github.com/Graylog2/graylog2-server/releases/download/0.20.3/graylog2-server-0.20.3.tgz
tar xvf graylog2-server-0.20.3.tgz
ln -s /opt/graylog2-server-0.20.3 /opt/graylog2-server
cp /opt/graylog2-server/graylog2.conf.example /etc/graylog2.conf
Generate a secret for the config (96 char)
pwgen -s 96|head -1
Generate a password for the admin user
echo -n p4ssw0rd | shasum -a 256
Add these to the Graylog2 config file
vim /etc/graylog2.conf
Alternatively use these commands to do it automatically
sed -ie "s/^password_secret =$/password_secret = `pwgen -s 96|head -1`/g" /etc/graylog2.conf
sed -ie "s/^root_password_sha2 =$/root_password_sha2 = `echo -n p4ssw0rd|sha256sum|awk '{print $1}'`/g" /etc/graylog2.conf
Create an init script
vim /etc/init.d/graylog2
---Copy below this line---
#!/bin/bash
### BEGIN INIT INFO
# Provides: graylog2
# Required-Start: $all
# Required-Stop: $all
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Starts GrayLog2
# Description: Starts GrayLog2 using start-stop-daemon
### END INIT INFO
NAME=graylog2
GL_HOME=/opt/graylog2-server
GL_PID=/var/run
CMD=$1 start() {
echo "Starting $NAME ..."
java -jar $GL_HOME/graylog2-server.jar &
}
stop() {
PID=`cat $GL_PID/$NAME.pid`
echo "Stopping $NAME ($PID) ..."
kill $PID
}
restart() {
echo "Restarting graylog2-server ..."
stop
start
}
case "$CMD" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
*)
echo "Usage $0 {start|stop|restart}"
RETVAL=1
esac
---End---
chmod 755 /etc/init.d/graylog2
update-rc.d graylog2 defaults
/etc/init.d/graylog2 start
Install Graylog2 web interface
cd /opt
wget https://github.com/Graylog2/graylog2-web-interface/releases/download/0.20.3/graylog2-web-interface-0.20.3.tgz
tar xvf graylog2-web-interface-0.20.3.tgz
ln -s /opt/graylog2-web-interface-0.20.3 /opt/graylog2-web-interface
Enter the secret created previously into the config file (/opt/graylog2-web-interface/conf/graylog2-web-interface.conf)
Alternatively use this command to do it automatically
sed -ie "s/^application.secret=\"\"/application.secret=\"`grep ^password_secret /etc/graylog2.conf|awk '{print $3}'`\"/g" conf/graylog2-web-interface.conf
Configure the REST URI
vim /opt/graylog2-web-interface/conf/graylog2-web-interface.conf
graylog2-server.uris="http://127.0.0.1:12900/"
Or automatically...
sed -ie "s/^graylog2-server.uris=\"\"/graylog2-server.uris=\"http:\/\/127.0.0.1:12900\/\"/g" conf/graylog2-web-interface.conf
Create an init script
vim /etc/init.d/graylog2
---Copy below line---
#!/bin/bash
### BEGIN INIT INFO
# Provides: graylog2-web-interface
# Required-Start: $graylog2
# Required-Stop: $graylog2
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Starts graylog2-web-interface
# Description: Starts graylog2-web-interface using start-stop-daemon
### END INIT INFO
NAME=graylog2-web-interface
GL_HOME=/opt/graylog2-web-interface/bin
GL_PID=/var/run
CMD=$1
start() {
echo "Starting $NAME ..."
$GL_HOME/graylog2-web-interface &
}
stop() {
PID=`cat $GL_PID/$NAME.pid`
echo "Stopping $NAME ($PID) ..."
kill $PID
}
restart() {
echo "Restarting $NAME..."
stop
start
}
case "$CMD" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
*)
echo "Usage $0 {start|stop|restart}"
RETVAL=1
esac
---End---
chmod 755 /etc/init.d/graylog2-web-interface
update-rc.d graylog2-web-interface defaults
/etc/init.d/graylog2-web-interface start
Fire up a browser and navigate to your graylog2 installation:
https://ipofserver:9000
Login with the admin account and the p4ssw0rd you created previously.
Configure your devices to send syslogs to this new server, and then instruct graylog2 to listen for the relevant incoming logs via
System > Inputs
Syslog UDP > Launch new input
Personally I use the following settings:
allow_override_date: true
port: 514
bind_address: 0.0.0.0
store_full_message: true
recv_buffer_size: 1048576
force_rdns: true
Finally, and because I only had a handful of devices and couldn't be bothered to create the DNS/rDNS, I simply added the hostnames of the devices to the hosts file to make navigating the logs a little easier.
Enjoy a fast, stable, open-source syslog server!
