Step 1: Update Your System

Before installing Graylog, ensure that your system is up to date. Run the following commands:

sudo dnf update -y

Keeping your system updated is crucial for security and performance, whether you're setting it up locally or on a VPS Windows Servers platform.

Step 2: Install Java

Graylog requires Java to run. Install OpenJDK 11 using the following command:

sudo dnf install java-11-openjdk -y

After installation, verify the Java installation:

java -version

Step 3: Install MongoDB

Graylog uses MongoDB as its database. To install MongoDB, follow these steps:

sudo nano /etc/yum.repos.d/mongodb-org-5.0.repo
            

Add the following content to the file:

[mongodb-org-5.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/8/mongodb-org/5.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-5.0.asc
            

After saving the file, install MongoDB:

sudo dnf install mongodb-org -y

Start and enable the MongoDB service:

sudo systemctl start mongod
sudo systemctl enable mongod
            

Step 4: Install Elasticsearch

Graylog uses Elasticsearch for storing and indexing log data. To install Elasticsearch, follow these steps:

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
sudo tee /etc/yum.repos.d/elasticsearch.repo <

After adding the repository, install Elasticsearch:

sudo dnf install elasticsearch -y

Start and enable the Elasticsearch service:

sudo systemctl start elasticsearch
sudo systemctl enable elasticsearch
            

Step 5: Install Graylog

Now, you can install Graylog. First, download the latest Graylog package:

wget https://downloads.graylog.org/repo/packages/graylog-4.3.8.tgz
tar -xvzf graylog-4.3.8.tgz
sudo mv graylog-4.3.8 /usr/share/graylog
            

Now, create a configuration file for Graylog:

sudo nano /usr/share/graylog/graylog.conf

Add the following configuration (update password_secret with a secure random string):

password_secret = your_password_secret
root_password_sha2 = your_root_password_hash
http_bind_address = 0.0.0.0:9000
http_enable = true
elasticsearch_shards = 4
elasticsearch_replicas = 0
            

Replace your_password_secret with a generated secure string and your_root_password_hash with the SHA-256 hash of your desired root password.

Step 6: Start Graylog

To start Graylog, run the following command:

sudo graylog-ctl run
            

Step 7: Access Graylog Web Interface

Open your web browser and navigate to:

http://your-server-ip:9000

Log in with the root username and password you set earlier.