Graylog Server setup

9 min read

Graylog is a centralized log management system.

Think of it as a giant, searchable diary for your entire IT infrastructure. Instead of logging into dozens of different servers or applications to read their individual text logs when something goes wrong, Graylog automatically collects all those logs and puts them in one place.

Here is what it does in three simple steps:

Collects: It gathers log data (error messages, system events, user activity) from your network, servers, and applications in real-time.
Organizes & Stores: It processes this massive amount of data and stores it in a highly structured way, making it incredibly fast to search.
Analyzes & Alerts: It provides a web dashboard where you can search through billions of logs in milliseconds, create visual graphs, and set up automatic alerts if it detects a specific error or security threat.

In short, it helps IT and security teams find and fix problems faster.

I made a script that installs Graylog 6.1 on Debian 12 using the Graylog 6.1 Full Installer,
which you can find below: #

Some NOTE

If you want to install graylog, create an install_graylog.sh file and make sure you access it as root.
# chmod +x install_graylog.sh
# ./install_graylog.sh

###################################
#!/bin/bash
# ==============================================================================
# Graylog 6.1 Full Install Script for Debian 12 (Bookworm)
# Components: Graylog 6.1, MongoDB 7.0, OpenSearch 2.x
# ==============================================================================
# 1. Safety Checks
if [ "$EUID" -ne 0 ]; then
echo "Please run as root"
exit
fi
echo "========================================================"
echo "   Graylog 6.1 Full Installer for Debian 12"
echo "========================================================"
# 2. Gather User Input
read -s -p "Enter the Password you want to use for the Graylog Admin: " ADMIN_PASS
echo
read -s -p "Confirm Password: " ADMIN_PASS_CONFIRM
echo
if [ "$ADMIN_PASS" != "$ADMIN_PASS_CONFIRM" ]; then
echo "Passwords do not match! Exiting."
exit 1
fi
echo "[+] Updating System..."
apt-get update && apt-get upgrade -y
apt-get install -y apt-transport-https openjdk-17-jre-headless uuid-runtime pwgen curl gnupg2 lsb-release
# ==============================================================================
# 3. Install MongoDB 7.0
# ==============================================================================
echo "[+] Installing MongoDB 7.0..."
# Import Key
curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | \
gpg --dearmor -o /usr/share/keyrings/mongodb-server-7.0.gpg --yes
# Add Repo
echo "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | \
tee /etc/apt/sources.list.d/mongodb-org-7.0.list
apt-get update
apt-get install -y mongodb-org
# Enable and Start
systemctl daemon-reload
systemctl enable mongod
systemctl restart mongod
# Verify
if systemctl is-active --quiet mongod; then
echo "MongoDB is running."
else
echo "MongoDB failed to start. Exiting."
exit 1
fi
# ==============================================================================
# 4. Install OpenSearch 2.x
# ==============================================================================
echo "[+] Installing OpenSearch 2.x..."
# Import Key
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | \
gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring
# Add Repo
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | \
tee /etc/apt/sources.list.d/opensearch-2.x.list
apt-get update
# OPENSEARCH_INITIAL_ADMIN_PASSWORD is required for 2.12+ installation to suppress interactive prompt
OPENSEARCH_INITIAL_ADMIN_PASSWORD=$(pwgen -N 1 -s 32) apt-get install -y opensearch
# Configure OpenSearch (Single Node)
# We disable the security plugin for a simple internal setup to avoid complex SSL bootstrapping in a script.
# If you need high security, you must manually configure certificates later.
echo "[+] Configuring OpenSearch..."
cat <<EOF > /etc/opensearch/opensearch.yml
cluster.name: graylog
node.name: ${HOSTNAME}
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
discovery.type: single-node
network.host: 0.0.0.0
action.auto_create_index: false
plugins.security.disabled: true
EOF
# Set Heap Size (1GB - Adjust if your server has >8GB RAM)
sed -i 's/-Xms1g/-Xms1g/g' /etc/opensearch/jvm.options
sed -i 's/-Xmx1g/-Xmx1g/g' /etc/opensearch/jvm.options
# Set Kernel Parameters
sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" >> /etc/sysctl.conf
# Enable and Start
systemctl daemon-reload
systemctl enable opensearch
systemctl restart opensearch
echo "Waiting for OpenSearch to initialize (20s)..."
sleep 20
# Check health
curl -s -X GET http://localhost:9200 > /dev/null
if [ $? -eq 0 ]; then
echo "OpenSearch is running."
else
echo "OpenSearch failed to start. Check /var/log/opensearch/graylog.log"
# We continue, sometimes it takes longer, but alert the user
fi
# ==============================================================================
# 5. Install Graylog 6.1
# ==============================================================================
echo "[+] Installing Graylog 6.1..."
wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
dpkg -i graylog-6.1-repository_latest.deb
rm graylog-6.1-repository_latest.deb
apt-get update
apt-get install -y graylog-server
# ==============================================================================
# 6. Configure Graylog
# ==============================================================================
echo "[+] Configuring Graylog Server..."
# Generate Secrets
PASSWORD_SECRET=$(pwgen -N 1 -s 96)
ROOT_PASSWORD_SHA2=$(echo -n "$ADMIN_PASS" | sha256sum | awk '{print $1}')
CONFIG_FILE="/etc/graylog/server/server.conf"
# Backup config
cp $CONFIG_FILE $CONFIG_FILE.bak
# Inject Configuration
sed -i "s/^password_secret =.*/password_secret = $PASSWORD_SECRET/" $CONFIG_FILE
sed -i "s/^root_password_sha2 =.*/root_password_sha2 = $ROOT_PASSWORD_SHA2/" $CONFIG_FILE
sed -i "s/^#http_bind_address =.*/http_bind_address = 0.0.0.0:9000/" $CONFIG_FILE
# Ensure timezone is set (optional but good practice)
sed -i "s/^#root_timezone =.*/root_timezone = UTC/" $CONFIG_FILE
# Enable and Start
systemctl daemon-reload
systemctl enable graylog-server
systemctl start graylog-server
echo "========================================================"
echo "   Installation Complete!"
echo "========================================================"
echo "Access Graylog at: http://$(hostname -I | awk '{print $1}'):9000"
echo "Username: admin"
echo "Password: (The one you entered at the start)"
echo ""
echo "Note: It may take 1-2 minutes for the Graylog interface to become available."
echo "Tail the logs with: tail -f /var/log/graylog-server/server.log"
###################################

###################################
#!/bin/bash

# ==============================================================================
# Graylog 6.1 Full Install Script for Debian 12 (Bookworm)
# Components: Graylog 6.1, MongoDB 7.0, OpenSearch 2.x
# ==============================================================================

# 1. Safety Checks
if [ "$EUID" -ne0 ]; then
  echo "Please run as root"
  exit
fi

echo "========================================================"
echo "   Graylog6.1 Full Installer for Debian12"
echo "========================================================"

# 2. Gather User Input
read -s -p "Enter the Password you want to use for the Graylog Admin: "ADMIN_PASS
echo
read -s -p "Confirm Password: "ADMIN_PASS_CONFIRM
echo

if [ "$ADMIN_PASS" != "$ADMIN_PASS_CONFIRM" ]; then
    echo "Passwords do not match! Exiting."
    exit1
fi

echo "[+] Updating System..."
apt-get update && apt-get upgrade -y
apt-get install -y apt-transport-https openjdk-17-jre-headless uuid-runtime pwgen curl gnupg2 lsb-release

# ==============================================================================
# 3. Install MongoDB 7.0
# ==============================================================================
echo "[+] Installing MongoDB7.0..."

# Import Key
curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | \
   gpg --dearmor -o /usr/share/keyrings/mongodb-server-7.0.gpg --yes

# Add Repo
echo "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | \
   tee /etc/apt/sources.list.d/mongodb-org-7.0.list

apt-get update
apt-get install -y mongodb-org

# Enable and Start
systemctl daemon-reload
systemctl enable mongod
systemctl restart mongod

# Verify
if systemctl is-active --quiet mongod; then
    echo "MongoDB is running."
else
    echo "MongoDB failed to start. Exiting."
    exit1
fi

# ==============================================================================
# 4. Install OpenSearch 2.x
# ==============================================================================
echo "[+] Installing OpenSearch2.x..."

# Import Key
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | \
    gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring

# Add Repo
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | \
    tee /etc/apt/sources.list.d/opensearch-2.x.list

apt-get update
# OPENSEARCH_INITIAL_ADMIN_PASSWORD is required for 2.12+ installation to suppress interactive prompt
OPENSEARCH_INITIAL_ADMIN_PASSWORD=$(pwgen -N1 -s32) apt-get install -y opensearch

# Configure OpenSearch (Single Node)
# We disable the security plugin for a simple internal setup to avoid complex SSL bootstrapping in a script.
# If you need high security, you must manually configure certificates later.
echo "[+] Configuring OpenSearch..."

cat <<EOF > /etc/opensearch/opensearch.yml
cluster.name: graylog
node.name: ${HOSTNAME}
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
discovery.type: single-node
network.host:0.0.0.0
action.auto_create_index: false
plugins.security.disabled: true
EOF

# Set Heap Size (1GB - Adjust if your server has >8GB RAM)
sed -i 's/-Xms1g/-Xms1g/g' /etc/opensearch/jvm.options
sed -i 's/-Xmx1g/-Xmx1g/g' /etc/opensearch/jvm.options

# Set Kernel Parameters
sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" >> /etc/sysctl.conf

# Enable and Start
systemctl daemon-reload
systemctl enable opensearch
systemctl restart opensearch

echo "Waiting for OpenSearch to initialize (20s)..."
sleep20

# Check health
curl -s -XGET http://localhost:9200 > /dev/null
if [ $? -eq0 ]; then
    echo "OpenSearch is running."
else
    echo "OpenSearch failed to start. Check /var/log/opensearch/graylog.log"
# We continue, sometimes it takes longer, but alert the user
fi

# ==============================================================================
# 5. Install Graylog 6.1
# ==============================================================================
echo "[+] Installing Graylog6.1..."

wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
dpkg -i graylog-6.1-repository_latest.deb
rm graylog-6.1-repository_latest.deb
apt-get update
apt-get install -y graylog-server

# ==============================================================================
# 6. Configure Graylog
# ==============================================================================
echo "[+] Configuring Graylog Server..."

# Generate Secrets
PASSWORD_SECRET=$(pwgen -N1 -s96)
ROOT_PASSWORD_SHA2=$(echo -n "$ADMIN_PASS" | sha256sum | awk '{print $1}')

CONFIG_FILE="/etc/graylog/server/server.conf"

# Backup config
cp $CONFIG_FILE $CONFIG_FILE.bak

# Inject Configuration
sed -i "s/^password_secret =.*/password_secret = $PASSWORD_SECRET/" $CONFIG_FILE
sed -i "s/^root_password_sha2 =.*/root_password_sha2 = $ROOT_PASSWORD_SHA2/" $CONFIG_FILE
sed -i "s/^#http_bind_address =.*/http_bind_address = 0.0.0.0:9000/" $CONFIG_FILE
# Ensure timezone is set (optional but good practice)
sed -i "s/^#root_timezone =.*/root_timezone = UTC/" $CONFIG_FILE

# Enable and Start
systemctl daemon-reload
systemctl enable graylog-server
systemctl start graylog-server

echo "========================================================"
echo "   Installation Complete!"
echo "========================================================"
echo "Access Graylog at: http://$(hostname -I | awk '{print $1}'):9000"
echo "Username: admin"
echo "Password: (The one you entered at the start)"
echo ""
echo "Note: It may take1-2 minutes for the Graylog interface to become available."
echo "Tail the logs with: tail -f /var/log/graylog-server/server.log"
###################################

Also, after installation, check those commands to make sure they meet your needs

# systemctl start graylog-server
# systemctl start opensearch
# systemctl status graylog-server
# systemctl status opensearch
# systemctl restart graylog-server
# systemctl restart opensearc

If you getting this type of error —–

The Problem: It’s just too slow.
The Solution: Increase the Timeout

Then follow these steps :

# mkdir -p /etc/systemd/system/opensearch.service.d
# echo -e "[Service]\nTimeoutStartSec=600" | sudo tee /etc/systemd/system/opensearch.service.d/override.conf
###################################
# systemctl daemon-reload
# systemctl start opensearch
# systemctl status opensearch