环境
操作系统:Centos 7.6.1810(Core) IP: 10.17.0.3
[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
修改时区
[root@localhost ~]# mv /etc/localtime /etc/localtime.bak
[root@localhost ~]# cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
安装jdk
[root@localhost ~]#yum install java-1.8.0-openjdk-headless.x86_64
安装pwgen
[root@localhost ~] yum install pwgen
安装mongodb
[root@localhost ~]# vim /etc/yum.repos.d/mongodb-org.repo
[mongodb-org-4.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/4.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-4.0.asc
[root@localhost ~]#yum install mongodb-org
[root@localhost ~]#systemctl daemon-reload
[root@localhost ~]#systemctl enable mongod.service
[root@localhost ~]#systemctl start mongod.service
安装Elasticsearch
[root@localhost ~]# vim /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-6.x]
name=Elasticsearch repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
[root@localhost ~]# yum install elasticsearch-oss
[root@localhost ~]# vim /etc/elasticsearch/elasticsearch.yml
cluster.name: graylog
action.auto_create_index: false //其他保持默认即可
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]#systemctl enable elasticsearch.service
[root@localhost ~]#systemctl start elasticsearch.service
安装Graylog
[root@localhost ~]#rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.0- repository_latest.rpm
[root@localhost ~]#yum install graylog-server
[root@localhost ~]# pwgen -N 1 -s 96 //设置password_secret
CFLVuFcTyGI9peEJZ2HNyXyu66KyUQkEPZPwR1fxgFla13uvrNwObTrcSWEvo4Lr3Coaj13ynmzRXNYZgvKMODvWD26JMUet
[root@localhost ~]# echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1 //设置root_passwd_sha
Enter Password: ×××× //输入密码,该密码为web登录的密码
88ffde508d4b842f60b83571499cbf2c94bf3b3e2417151d85bbb6b8733b9647
//配置Graylog
[root@localhost ~]# vim /etc/graylog/server/server.conf
//第55行
password_secret = CFLVuFcTyGI9peEJZ2HNyXyu66KyUQkEPZPwR1fxgFla13uvrNwObTrcSW Evo4Lr3Coaj13ynmzRXNYZgvKMODvWD26JMUet
//第66行
root_password_sha2 = 88ffde508d4b842f60b83571499cbf2c94bf3b3e2417151d85bbb6b 8733b9647
//第74行 时区
root_timezone = Asia/Shanghai
//第103行
http_bind_address = 10.17.0.3:9000
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl enable graylog-server
Created symlink from /etc/systemd/system/multi-user.target.wants/graylog-server.service to /usr/lib/systemd/system/graylog-server.service.
[root@localhost ~]# systemctl start graylog-server
#配置防火墙 [root@localhost ~]# firewall-cmd --add-port=9000/tcp --permanent success //因为1000以下端口在linux中为特权端口,不能直接使用,而514又是网络设备日志的syslog的默认端口,所以这里做下转发 [root@localhost ~]# firewall-cmd --add-forward-port=port=514:proto=tcp:toport=1514 --permanent success
[root@localhost ~]# firewall-cmd --add-forward-port=port=514:proto=udp:toport=1514 --permanent success [root@localhost ~]# firewall-cmd --reload success
至此,已经安装完毕,登录http://ip:9000即可访问,账号admin