Graylog syslog server on Raspberry Pi 4 (8gb)
This is how I installed graylog on my Pi.
What is needed:
1.- Raspberry Pi 4 - 8 GB Ram with firmware patch to boot from USB.
2.- Geekworm Raspberry Pi 4 mSATA SSD Adapter X857.
3.- MSata drive (using a 250 gb drive).
4.- Raspbian/Debian, Ubuntu aarch64.
5.- Network connection (Ethernet, WiFi and BT disabled).
6.- Rpi4 heatsinks (optional/recommended).
Procedure:
Install OS (Raspbian Aarch64) on the MSata drive, boot the raspberry pi and then do
# sudo apt update && apt full-upgrade -y
# sudo apt install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr gnupg wget zip curl
Install MongoDB
# curl -s https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add -
# echo "deb [ arch=arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.2 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.2.list
# sudo apt update && sudo apt install mongodb-org -y
# sudo systemctl enable mongod
# sudo systemctl start mongod
# sudo systemctl status mongod
Install Elasticsearch
# wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
# echo "deb [ arch=arm64 ] https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
# sudo apt update && sudo apt install elasticsearch-oss -y
# sudo tee -a /etc/elasticsearch/elasticsearch.yml > /dev/null <<EOT cluster.name: graylog network.host: 127.0.0.1 http.port: 9200 action.auto_create_index: false EOT
# sudo systemctl daemon-reload
# sudo systemctl enable elasticsearch.service
# sudo systemctl restart elasticsearch.service
Install Graylog
Download the latest graylog-x.x.x.tgz from https://www.graylog.org/downloads-2 and scp it to your PI or
# cd opt
# wget https://downloads.graylog.org/releases/graylog/graylog-x.x.x.tgz
# sudo tar -xf graylog-x.x.x.tgz
# sudo mv /opt/graylog-x.x.x /opt/graylog
# sudo rm graylog-x.x.x.tgz
# vi /etc/graylog/server/server.conf and configure to your needs
To start the server do:
# cd /opt/graylog/bin
# ./graylogctl start
After the server started go to http://server-ip:9000 and use the user admin with the password previously configured, create an input and that should be all.
To configure password and settings on server.conf please refer to graylog documentation.