티스토리 뷰

개요

  • CentOS 7에서 Graylog 3 Server를 설치하는 방법을 소개한다.

사전조건

  • Grarylog 3 Server를 설치할 각 노드에 MongoDB가 먼저 설치되어야 한다. 설치 방법은 이 글을 참고한다. (MongoDBGraylog의 모든 환경설정을 저장하는 데이터베이스로 사용된다.)
  • Grarylog 3 Server 설치 전 별개의 노드에 Elasticsearch 6가 설치되어야 한다. 설치 방법은 이 글을 참고한다. (ElasticsearchGraylog로 전송되는 모든 로그의 저장소로 사용된다.)

Graylog 3 Server 설치

  • 아래는 CentOS 7Graylog 3 Server를 설치하는 방법이다.
### 운영체제 업데이트
$ sudo yum -y update

### Zulu OpenJDK 8 설치
$ sudo rpm --import http://repos.azulsystems.com/RPM-GPG-KEY-azulsystems
$ sudo curl -o /etc/yum.repos.d/zulu.repo http://repos.azulsystems.com/rhel/zulu.repo
$ sudo yum -y install zulu-8
$ sudo bash -c 'echo "export JAVA_HOME=/usr/lib/jvm/zulu-8" >> /etc/environment'
$ sudo bash -c 'echo "export JRE_HOME=/usr/lib/jvm/zulu-8/jre" >> /etc/environment'

### Graylog 3 설치
$ sudo rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.0-repository_latest.rpm
$ sudo yum -y install graylog-server

### Graylog 3 비밀번호 해시 생성
$ sudo pwgen -N 1 -s 96
9Dz0g8s6YvGkZHdfm1YHVNX7RfEjyJGdawXHwpFIAaGM802dPpJouksI06t2A8Pj2QIDIMXLK01qkbAmgXPdmoI7bzlZr2Lk

$ echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
Enter Password: admin
8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

### Graylog 3 설정
$ sudo vi /etc/graylog/server/server.conf
password_secret = 9Dz0g8s6YvGkZHdfm1YHVNX7RfEjyJGdawXHwpFIAaGM802dPpJouksI06t2A8Pj2QIDIMXLK01qkbAmgXPdmoI7bzlZr2Lk
root_password_sha2 = 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
root_email = "jsonobject@gmail.com"
root_timezone = UTC
is_master = true
http_bind_address = 127.0.0.1:9000
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
elasticsearch_shards = 1
elasticsearch_replicas = 0

### Graylog 3 방화벽 개방
$ sudo firewall-cmd --permanent --add-port=9000/tcp
$ sudo firewall-cmd --reload

### Graylog 3 Server 실행
$ sudo systemctl daemon-reload
$ sudo systemctl enable graylog-server.service
$ sudo systemctl start graylog-server.service
$ sudo tail -f /var/log/graylog-server/server.log
2019-08-10T15:58:52.676Z INFO  [ServerBootstrap] Graylog server up and running.

Graylog 3 Server 실행 확인

$ curl -X GET http://127.0.0.1:9000
HTTP/1.1 200 OK
X-UA-Compatible: IE=edge
X-Graylog-Node-ID: 327adb40-6e1f-48df-909f-8bcd35210324
Content-Type: text/html
Date: Sat, 10 Aug 2019 16:06:20 GMT
Content-Length: 1314
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="robots" content="noindex, nofollow">
    <meta charset="UTF-8">
    <title>Graylog Web Interface</title>
    <link rel="shortcut icon" href="http://127.0.0.1:9000/assets/favicon.png">
  </head>
  <body>
    <script src="http://127.0.0.1:9000/config.js"></script>
    <script src="http://127.0.0.1:9000/assets/vendor.4024e2a8db732781a971.js"></script>
    <script src="http://127.0.0.1:9000/assets/polyfill.a5e2fb591e8fd54ee4ef.js"></script>
    <script src="http://127.0.0.1:9000/assets/builtins.a5e2fb591e8fd54ee4ef.js"></script>
    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.b864ba54b438ac0bdc48.js"></script>
    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.bcc87290018e859a8a9e.js"></script>
    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.8ae7cb13983ce33eeb5b.js"></script>
    <script src="http://127.0.0.1:9000/assets/app.a5e2fb591e8fd54ee4ef.js"></script>
  </body>
</html>

$ curl -i -H 'Accept: application/json' http://127.0.0.1:9000/api
HTTP/1.1 200 OK
X-Graylog-Node-ID: 327adb40-6e1f-48df-909f-8bcd35210324
X-Runtime-Microseconds: 34388
Content-Type: application/json
Date: Sat, 10 Aug 2019 16:07:45 GMT
Content-Length: 232
{  
   "cluster_id":"20ed5de4-4686-450e-8f12-a9abf225b17b",
   "node_id":"327adb40-6e1f-48df-909f-8bcd35210324",
   "version":"3.0.2+1686930",
   "tagline":"Manage your logs in the dark and have lasers going and make it look like you're from space!"
}
댓글
댓글쓰기 폼