graylog2 是一个开源的日志存储系统,是由java语言编写的server,能够接收TCP,UDP,AMQP的协议发送的日志信息,并且基于mongodb数据库服务器快速存储,能够通过一个基于ruby编写的web管理界面,让轻松管理你的日志。

相对ELK，部署简单，轻量

Graylog官网 (opens new window)

Graylog文档 (opens new window)

graylog 包下载地址 (opens new window)

Graylog版本选择 (opens new window)

centos7部署graylog-server

graylog-3.1 安装官方文档 (opens new window)

• 运行环境

    Java ( >= 8 )
    MongoDB (4.0, 4.2) 存储Graylog相关配置
    Elasticsearch (6.x  or 7.x) 持久化存储和检索日志文件数据（生产环境虚机单独部署）
    客户端：logstash/nxlog 日志收集工具
  

虚拟机安装跳转地址： jdk，ES，MongoDB

• rpm安装,版本graylog-server-3.1.2

rpm -Uvh https://packages.graylog2.org/repo/el/stable/3.1/x86_64/graylog-server-3.1.2-1.noarch.rpm
yum install graylog-server -y

• rpm安装,版本4.2

rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-4.2-repository_latest.rpm
yum install graylog-server -y

修改以下参数：vi /etc/graylog/server/server.conf

[root@basic ~]# pwgen -N 1 -s 96
25cQkxWstrS6IOk8HM0RBND3SmM40etEnOBZqH8EhCQCMSt8jXQycrfyuKzpoLkAKzS97oOhtCRsSqg0ArCiHUB7GR4ZGMiq
[root@basic ~]# echo -n yfk123456 | sha256sum 
f68c61335907732ecf955217c2cba549cfd766d80081f0e44719103fa7a17dbb  -

password_secret = 25cQkxWstrS6IOk8HM0RBND3SmM40etEnOBZqH8EhCQCMSt8jXQycrfyuKzpoLkAKzS97oOhtCRsSqg0ArCiHUB7GR4ZGMiq
root_username = admin
root_password_sha2 = f68c61335907732ecf955217c2cba549cfd766d80081f0e44719103fa7a17dbb
root_timezone = Asia/Shanghai

http_bind_address = 192.168.108.253:9001

elasticsearch_hosts = http://192.168.108.253:9200

mongodb_uri = mongodb://192.168.108.253/graylog

创建graylog java运行命令软链接：ln -s /usr/local/jdk1.8.0_311/bin/java /usr/bin/java

• 启动

systemctl start  graylog-server.service

systemctl enable  graylog-server.service

• 登录

  http://192.168.108.253:9001, 用户/密码：admin/yfk123456