How to Install Graylog on CentOS

By on January 22nd, 2018

How to Install Graylog on CentOS

Graylog is a most powerful log management tool. It is used to monitor unusual activity on the server like monitoring SSH logins. You can easily collect and analyze remote system logs centrally using Graylog. It is based on Elastic search, Java, MongoDB, and Scala.

First, you need to login to server via SSH as root user and do the below steps.


1) Update the server.

# yum update


2) To install Graylog, we will need to install the below additional packages.

# yum install java-1.8.0-openjdk-headless.x86_64 -y

# yum install epel-release -y

# yum install pwgen -y


3) Install MongoDB.

By default, MongoDB is not available in CentOS repository. So you need to create a MongoDB repository First. Open a file and add the below code to it.

# vi /etc/yum.repos.d/mongodb-org-3.2.repo


name=MongoDB Repository





Then you need to install MongoDB using the below command.

# yum install mongodb-org -y

Last you need to start and enable the MongoDB service.

# chkconfig –add mongod

# systemctl daemon-reload

# systemctl enable mongod.service

# systemctl start mongod.service


4) Then you need to install and configure Elasticsearch.

First, you need to import GPG key using the below command.

rpm –import

Then you need to add the repository. Open a file and add the below code.

vi /etc/yum.repos.d/elasticsearch.repo


name=Elasticsearch repository for 2.x packages





Then install Elasticsearch using the command.

# yum install elasticsearch -y

Change the cluster name in Elasticsearch configuration file

# vi /etc/elasticsearch/elasticsearch.yml graylog

Then you need to start and enable it using the below commands.

# chkconfig –add elasticsearch

# systemctl daemon-reload

# systemctl enable elasticsearch.service

# systemctl restart elasticsearch.service


5) Install and configure Graylog.

Download and install Graylog repository using the following command:

# rpm -Uvh

Install the Graylog server using the below command

# yum install graylog-server -y

When you install the Graylog server then you need to generate a secret key using the below command.

# pwgen -N 1 -s 96


Finally create a hash password for the root user.

echo -n Password | sha256sum


Edit the Graylog configuration file and make the changes as follow.

#  vi /etc/graylog/server/server.conf

password_secret = Enter the output of secret key

root_password_sha2 = Enter the output of root password

root_timezone = UTC

elasticsearch_http_enabled = false

elasticsearch_discovery_zen_ping_unicast_hosts = graylog2-server-ip:9300

elasticsearch_shards = 1

elasticsearch_replicas = 0

mongodb_useauth = false

Finally, restart the Graylog server to enable all changes.

# systemctl restart graylog-server


6) Finally, you need to install Graylog web interface to access it via web.

# yum -y install graylog-web

Edit the configuration file and add the following to enable web interface.


application.secret=”Enter the output of secret key “

Last restart and enable graylog-web on boot.

# systemctl enable graylog-web

# systemctl restart graylog-web


7) Adding ports to firewall using the below command.

# firewall-cmd –permanent –zone=public –add-port=9000/tcp

# firewall-cmd –permanent –zone=public –add-port=12900/tcp

# firewall-cmd –permanent –zone=public –add-port=1514/tcp

# firewall-cmd –reload


8) Install policycoreutils-python package to manage SELinux using the below command.

# yum install policycoreutils-python -y

Use the below command to allow the web server to access the network.

# sudo setsebool -P httpd_can_network_connect 1

Use the command to allow the Graylog REST API and web interface.

# semanage port -a -t http_port_t -p tcp 9000

To allow the Elasticsearch HTTP API:

# semanage port -a -t http_port_t -p tcp 9200

To allow MongoDB default port.

# semanage port -a -t mongod_port_t -p tcp 27017

Now you have successfully install Graylog and you can access it in web interface using the link  http://your_ip_address:9000


If you need any further help please do reach our support department.

Leave a Reply