环境

操作系统：Centos 7.6.1810（Core） IP： 10.17.0.3

1[root@localhost ~]# cat /etc/redhat-release 
2 CentOS Linux release 7.6.1810 (Core)

修改时区

1[root@localhost ~]# mv /etc/localtime /etc/localtime.bak
2[root@localhost ~]# cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

安装jdk

[root@localhost ~]#yum install java-1.8.0-openjdk-headless.x86_64

安装pwgen

[root@localhost ~] yum install pwgen

安装mongodb

1[root@localhost ~]# vim /etc/yum.repos.d/mongodb-org.repo
2[mongodb-org-4.0]
3name=MongoDB Repository
4baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/4.0/x86_64/
5gpgcheck=1
6enabled=1
7gpgkey=https://www.mongodb.org/static/pgp/server-4.0.asc
8[root@localhost ~]#yum install mongodb-org
9[root@localhost ~]#systemctl daemon-reload
10[root@localhost ~]#systemctl enable mongod.service
11[root@localhost ~]#systemctl start mongod.service

安装Elasticsearch

1[root@localhost ~]# vim /etc/yum.repos.d/elasticsearch.repo
2[elasticsearch-6.x]
3name=Elasticsearch repository for 6.x packages
4baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum
5gpgcheck=1
6gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
7enabled=1
8autorefresh=1
9type=rpm-md
10[root@localhost ~]# yum install elasticsearch-oss
11[root@localhost ~]# vim /etc/elasticsearch/elasticsearch.yml 
12cluster.name: graylog
13action.auto_create_index: false  //其他保持默认即可
14[root@localhost ~]# systemctl daemon-reload
15[root@localhost ~]#systemctl enable elasticsearch.service
16[root@localhost ~]#systemctl start elasticsearch.service

安装Graylog

1[root@localhost ~]#rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.0-        repository_latest.rpm
2[root@localhost ~]#yum install graylog-server
3[root@localhost ~]# pwgen -N 1 -s 96   //设置password_secret
4CFLVuFcTyGI9peEJZ2HNyXyu66KyUQkEPZPwR1fxgFla13uvrNwObTrcSWEvo4Lr3Coaj13ynmzRXNYZgvKMODvWD26JMUet
5[root@localhost ~]# echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1  //设置root_passwd_sha
6Enter Password: ××××  //输入密码，该密码为web登录的密码
7 88ffde508d4b842f60b83571499cbf2c94bf3b3e2417151d85bbb6b8733b9647
8//配置Graylog
9[root@localhost ~]# vim /etc/graylog/server/server.conf
10//第55行
11password_secret = CFLVuFcTyGI9peEJZ2HNyXyu66KyUQkEPZPwR1fxgFla13uvrNwObTrcSW    Evo4Lr3Coaj13ynmzRXNYZgvKMODvWD26JMUet
12//第66行
13root_password_sha2 = 88ffde508d4b842f60b83571499cbf2c94bf3b3e2417151d85bbb6b    8733b9647
14//第74行 时区
15root_timezone = Asia/Shanghai
16//第103行
17http_bind_address = 10.17.0.3:9000
18[root@localhost ~]# systemctl daemon-reload
19[root@localhost ~]# systemctl enable graylog-server 
20Created symlink from /etc/systemd/system/multi-user.target.wants/graylog-server.service to /usr/lib/systemd/system/graylog-server.service.
21[root@localhost ~]# systemctl start graylog-server

#配置防火墙 [root@localhost ~]# firewall-cmd --add-port=9000/tcp --permanent success //因为1000以下端口在linux中为特权端口，不能直接使用，而514又是网络设备日志的syslog的默认端口，所以这里做下转发 [root@localhost ~]# firewall-cmd --add-forward-port=port=514:proto=tcp:toport=1514 --permanent success
[root@localhost ~]# firewall-cmd --add-forward-port=port=514:proto=udp:toport=1514 --permanent success [root@localhost ~]# firewall-cmd --reload success

至此，已经安装完毕，登录http://ip:9000即可访问，账号admin

Graylog 安装

环境