新版graylog2安装过程

Graylog是一个开源的 log 收容器，背后的储存是搭配 mongodb，而搜寻引擎则由 elasticsearch 提供。以前版本主要有两个部分集合而成 server 与 web interface，网上搜到的教程也大都如此，而且安装过程似乎都很复杂似的，新版的graylog已经将二部分合二为一了，安装过程非常简单，而且方便集群的部署和维护。以下是安装过程，系统是centos。

 
 

#yum -y install java-1.8.0-openjdk-headless.x86_64

 
 

=============disable selinux and firewall=============

 
 

#systemctl stop firewalld.service

#systemctl disable firewalld.service

 
 

# sestatus

SELinux status: enabled

SELinuxfs mount: /sys/fs/selinux

SELinux root directory: /etc/selinux

Loaded policy name: targeted

Current mode: enforcing

Mode from config file: disabled

Policy MLS status: enabled

Policy deny_unknown status: allowed

Max kernel policy version: 28

 
 

 
 

#setenforce 0

#vim /etc/sysconfig/selinux

SELINUX=disable

 
 

 
 

========================================= install MongoDB===================

# vi /etc/yum.repos.d/mongodb-org-3.2.repo

[mongodb-org-3.2]

name=MongoDB Repository

baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.2/x86_64/

gpgcheck=1

enabled=1

gpgkey=https://www.mongodb.org/static/pgp/server-3.2.asc

 
 

 
 

# yum -y install mongodb-org

#sudo chkconfig --add mongod

#sudo systemctl daemon-reload

#sudo systemctl enable mongod.service

#sudo systemctl start mongod.service

 
 

===================================Install Elasticsearch ===========================================

 
 

# rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

 
 

# vi /etc/yum.repos.d/elasticsearch.repo

[elasticsearch-2.x]

name=Elasticsearch repository for 2.x packages

baseurl=https://packages.elastic.co/elasticsearch/2.x/centos

gpgcheck=1

gpgkey=https://packages.elastic.co/GPG-KEY-elasticsearch

enabled=1

 
 

# yum -y install elasticsearch

 
 

 
 

# vi /etc/elasticsearch/elasticsearch.yml

cluster.name: graylog2

 
 

#chkconfig --add elasticsearch

#systemctl daemon-reload

#systemctl enable elasticsearch.service

#systemctl restart elasticsearch.service

 
 

# curl -X GET http://localhost:9200

 
 

{

"status" : 200,

"name" : "Silver Fox",

"cluster_name" : "graylog2"

},

"tagline" : "You Know, for Search"

}

 
 

========================================== install graylog2 =============================

#rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-2.0-repository_latest.rpm

#yum install graylog-server

 
 

# vi /etc/graylog/server/server.conf

password_secret = 0b4e7a0e5fe84ad35fb5f95b9ceeac790b4e7a0e5fe84ad35fb5f95b9ceeac79 //123456

root_password_sha2 =ed02457b5c41d964dbd2f2a609d63fe1bb7528dbe55e1abf5b52c249cd735797 //aaaaaa

 
 

web_listen_uri = http://0.0.0.0:9000/

rest_listen_uri = http://0.0.0.0:12900/

rest_transport_uri = http://192.168.1.135:12900/

elasticsearch_shards = 1

elasticsearch_replicas = 0

mongodb_useauth = false

#sudo chkconfig --add graylog-server

#systemctl daemon-reload

#systemctl enable graylog-server.service

#systemctl start graylog-server.service

 
 

 
 

========================================test==================================================

[root@graylog test]# netstat -nltp

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN 2246/mongod

tcp 0 0 0.0.0.0:28010 0.0.0.0:* LISTEN 7595/./mongod

tcp 0 0 0.0.0.0:28011 0.0.0.0:* LISTEN 9352/./mongod

tcp 0 0 0.0.0.0:28012 0.0.0.0:* LISTEN 9443/./mongod

tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 2348/dnsmasq

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 993/sshd

tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 982/cupsd

tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2192/master

tcp6 0 0 :::9000 :::* LISTEN 1010/java

tcp6 0 0 :::1514 :::* LISTEN 1010/java

tcp6 0 0 :::12202 :::* LISTEN 1010/java

tcp6 0 0 :::22222 :::* LISTEN 1010/java

tcp6 0 0 127.0.0.1:9200 :::* LISTEN 1013/java

tcp6 0 0 ::1:9200 :::* LISTEN 1013/java

tcp6 0 0 127.0.0.1:9300 :::* LISTEN 1013/java

tcp6 0 0 ::1:9300 :::* LISTEN 1013/java

tcp6 0 0 :::22 :::* LISTEN 993/sshd

tcp6 0 0 ::1:631 :::* LISTEN 982/cupsd

tcp6 0 0 ::1:25 :::* LISTEN 2192/master

tcp6 0 0 :::12900 :::* LISTEN 1010/java

tcp6 0 0 127.0.0.1:9350 :::* LISTEN 1010/java

tcp6 0 0 ::1:9350 :::* LISTEN 1010/java

tcp6 0 0 :::11111 :::* LISTEN 1010/java

[root@graylog test]#