MirrorNest
← All guides

Graylog

Centralized log management: collect, search, and alert on logs from your whole infrastructure.

Target: Ubuntu 22.04 LTSLoggingMonitoringOfficial homepage ↗Official docs ↗
This guide is synthesized from Graylog's own official documentation, linked above — always cross-check exact package/version names there before running these commands on a production server, since distro and project versions move over time.

  1. 1Install prerequisites

    sudo apt update
    sudo apt install -y apt-transport-https openjdk-17-jre-headless uuid-runtime pwgen

  2. 2Install MongoDB

    Graylog pins a specific supported MongoDB version range per release — check the official docs link above for the exact version before following MongoDB's own official Ubuntu install guide.

    sudo systemctl enable --now mongod

    This assumes MongoDB is already installed via its own official repo — install it first per Graylog's compatibility matrix.

  3. 3Install OpenSearch

    Graylog also pins a specific OpenSearch version range — check the compatibility matrix in the official docs before installing. For a single server, set discovery.type: single-node in /etc/opensearch/opensearch.yml.

    sudo systemctl enable --now opensearch

  4. 4Add the Graylog repository and install

    wget https://packages.graylog2.org/repo/packages/graylog-6.0-repository_latest.deb
    sudo dpkg -i graylog-6.0-repository_latest.deb
    sudo apt update
    sudo apt install graylog-server -y

  5. 5Generate secrets

    The first command gives you a value for password_secret; the second gives root_password_sha2 (hash of your chosen admin password).

    pwgen -N 1 -s 96
    echo -n 'yourpassword' | sha256sum

  6. 6Configure the server

    Edit /etc/graylog/server/server.conf and set password_secret, root_password_sha2, and http_bind_address (e.g. 0.0.0.0:9000).

    sudo nano /etc/graylog/server/server.conf

  7. 7Start and enable Graylog

    sudo systemctl enable --now graylog-server

  8. 8Log in

    Open http://your-server-ip:9000 — username admin, password is whatever you hashed above.