Wednesday 6 November 2013

Install and setup graylog2 on Ubuntu 12.04

References

Setting GrayLog2 Server

Up to date Ubuntu 12.04 server x64

apt-get update && apt-get upgrade

Installing mongodb

echo -e "deb http://downloads-distro.mongodb.org/repo/ubuntu-upstart dist 10gen\n" > /etc/apt/sources.list.d/mongodb-10gen.list
apt-get update
apt-get install mongodb-10gen

create the mongodb user:

mongo
use graylog2
db.addUser("grayloguser", "123")
exit

Installing Java

apt-get install openjdk-6-jdk 
ln -s /usr/lib/jvm/java-6-openjdk-amd64 java-6-openjdk
cat <<EOF > /etc/profile.d/java.sh
export JAVA_HOME=/usr/lib/jvm/java-1.6.0-openjdk-amd64
EOF

source /etc/profile.d/java.sh

Installing elasticsearch

wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-0.20.4.deb 
dpkg -i elasticsearch- 0.20.4.deb
service elasticsearch start

Check Elasticsearch service

curl -XGET 'http://localhost:9200/_cluster/health?pretty=true'
output
{
"cluster_name" : "elasticsearch",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 0,
"active_shards" : 0,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0
}

Installing graylog2-server

mkdir -p /opt/graylog2 && cd /tmp
wget http://download.graylog2.org/graylog2-server/graylog2-server-0.11.0.tar.gz
tar -xzvf graylog2-server-0.11.0.tar.gz -C /opt/graylog2
cd /opt/graylog2
ln -sf graylog2-server-0.11.0 graylog2-server
cp graylog2-server/graylog2.conf.example /etc/graylog2.conf
You should change the value of the mongodb_password too If you changed the mongodb_user's password in mongodb console.

Configuring service

cat <<EOF > /etc/init/graylog2-server.conf
description "graylog2 server"
author  "Mick Pollard <aussielunix@gmail.com>"
modified  "DaeHyung <daehyung@gmail.com>"
start on runlevel [2345]
stop on runlevel [06]
# tell upstart we're creating a daemon
# upstart manages PID creation for you.
expect fork
script
  cd /opt/graylog2/graylog2-server
  exec sudo java -jar graylog2-server.jar > /opt/graylog2/graylog2-server/log/graylog2.log 2>&1 &
  emit graylog2-server_running
end script
EOF
touch /opt/graylog2/graylog2-server/log/graylog2.log
cd /var/log && ln -s /opt/graylog2/graylog2-server/log/graylog2.log
service graylog2-server start

Installing graylog2-web-interface

apt-get install curl
 
cd /tmp
wget http://download.graylog2.org/graylog2-web-interface/graylog2-web-interface-0.11.0.tar.gz
tar -xzvf graylog2-web-interface-0.11.0.tar.gz -C /opt/graylog2
cd /opt/graylog2
ln -sf graylog2-web-interface-0.11.0 graylog2-web-interface
chown www-data.www-data -R /opt/graylog2/graylog2-web-interface

Installing RUBY 2.0

Preparing

apt-get install build-essential libcurl4-openssl-dev libssl-dev zlib1g-dev

Installing Ruby 2.0

cd /tmp
wget http://ftp.ruby-lang.org/pub/ruby/2.0/ruby-2.0.0-p0.tar.gz
tar -xzvf ruby-2.0.0-p0.tar.gz -C /opt/graylog2
cp ruby-2.0.0-p0 
cd /opt/graylog2/ruby-2.0.0-p0 
./configure && make && make install
update-alternatives --install /usr/bin/ruby ruby /usr/local/bin/ruby 20000

Check ruby is working

ruby -v

Installing bundler and others

gem install bundler --no-rdoc --no-ri

Change the version of json in the Gemfile

/opt/graylog2/graylog2-web-interface/Gemfile
...skiped...
gem 'json', '~> 1.5.5'               ===> change 1.5.5 to 1.7.7
...skiped...
Run bundle command for update json
bundle update json
bundle install

Installing web server daemon

apt-get install apache2-mpm-prefork apache2-prefork-dev libapr1-dev libaprutil1-dev
or
apt-get install nginx

Get passenger and make sure you pull the pre version

The Passenger is A modern web server and application server for Ruby, Python and Node.js, optimized for performance, low memory usage and ease of use.
Passenger web site : http://rubygems.org/gems/passenger

Installing the passenger module (for apache)

gem install passenger --no-rdoc --no-ri --pre
(For Apache) passenger-install-apache2-module
(For Nginx) passenger-install-nginx-module

Creating configuration files (for apache)

cd /etc/apache2/mods-available
cat <<EOF > passenger.conf
PassengerRoot /usr/local/lib/ruby/gems/2.0.0/gems/passenger-4.0.23
PassengerDefaultRuby /usr/local/bin/ruby
EOF
 
cat <<EOF > passenger.load
LoadModule passenger_module /usr/local/lib/ruby/gems/2.0.0/gems/passenger-4.0.23/buildout/apache2/mod_passenger.so
EOF
 
cd ../mods-enabled
ln -sf ../mods-available/passenger.conf
ln -sf ../mods-available/passenger.load
 
cd ../sites-available
mv default default.backup
 
cat <<EOF > default
<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        DocumentRoot /opt/graylog2/graylog2-web-interface/public
        RailsEnv 'production'
        <Directory /opt/graylog2/graylog2-web-interface/public>
                 # This relaxes Apache security settings.
                 AllowOverride all
                 # MultiViews must be turned off.
                 Options -MultiViews
        </Directory>
        ErrorLog ${APACHE_LOG_DIR}/error.log
        LogLevel warn
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
EOF

Editing elasticsearch and other items

/etc/elasticsearch/elasticsearch.yml
...skipped...
cluster.name: graylog2
node.name: "graylog2-elasticserver"
node.master: true
node.data: true
/etc/graylog2-elasticsearch.yml
cluster.name: graylog2
node.name: "graylog2-server"
transport.tcp.port: 9390

Restarting services

service apache2 start

Access Graylog2 Web

Screenshots






Gathering log from other servers(syslog clients)

CentOS6 case
cat <<EOF > /etc/rsyslog.d/graylog2.conf
# Forward all logs to Graylog2
*.* @192.168.126.133 #udp forwarding
EOF
 
service restart rsyslog

Posted by at
Labels: ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)