centos7安裝graylog

1.安裝mongodb，添加mongodb的源

vim /etc/yum.repos.d/mongodb-org-3.2.repo

[mongodb-org-3.6]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.6/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-3.6.asc

安裝mongodb

yum install mongodb-org

此處可以修改配置文件/etc/mongod.conf ，更改db的目錄，默認目錄在/var/lib下

啓動mongodb

/etc/init.d/mongod start

2.安裝Elasticsearch，需要先安裝java

yum install java

添加Elasticsearch的源
vim /etc/yum.repos.d/elasticsearch.repo

[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

安裝elasticsearch

yum install elasticsearch

修改/etc/elasticsearch/elasticsearch.yml文件在最後添加

cluster.name: graylog                                        #集羣名稱
nodename: graylog                                            #節點名稱
path.data: /data/elasticsearch/data                          #數據存儲路徑
path.logs: /data/elasticsearch/log                           #日誌文件路徑
network.host: 192.168.0.102                                  #啓動時綁定的IP地址
transport.tcp.port: 9300                                     #啓動時綁定的端口
http.port: 9200                                              #http頁面的端口
bootstrap.memory_lock: true                                  #鎖定內存，不實用swap

創建自定義目錄並設置權限

chown elasticsearch.elasticsearch /data/elasticsearch/ -R
chmod 750 /data/elasticsearch/ -R

vim /etc/security/limits.conf添加如下參數

# End of file
* soft nproc 65525
* hard nproc 65535
* soft nofile 65536
* hard nofile 65536

# allow user 'elasticsearch' mlockall
* soft memlock unlimited
* hard memlock unlimited

啓動elasticsearch,此處注意，不要用root用戶起動服務

/etc/init.d/elasticsearch start

如果有以下報錯

[2018-12-17T16:15:18,584][WARN ][o.e.b.JNANatives         ] Unable to lock JVM Memory: error=12, reason=Cannot allocate memory
[2018-12-17T16:15:18,588][WARN ][o.e.b.JNANatives         ] This can result in part of the JVM being swapped out.
[2018-12-17T16:15:18,588][WARN ][o.e.b.JNANatives         ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
[2018-12-17T16:15:18,588][WARN ][o.e.b.JNANatives         ] These can be adjusted by modifying /etc/security/limits.conf, for example: 
        # allow user 'elasticsearch' mlockall
        elasticsearch soft memlock unlimited
        elasticsearch hard memlock unlimited

添加/etc/systemd/system/elasticsearch.service.d/elasticsearch.conf

[Service]
LimitMEMLOCK=infinity

如何驗證elasticsearch是否正常啓動？
可以訪問配置文件裏配置的IP加http端口，正常是會出現如下內容

3.安裝Graylog

rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-2.4-repository_latest.rpm
yum install graylog-server

安裝epel倉庫和pwgen軟件

rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
yum install -y pwgen          #生成密碼使用

pwgen -N 1 -s 96                                                                           #密鑰
echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1 #登陸密碼

修改配置文件/etc/graylog/server/server.conf

password_secret = XXX                         #前面生成的密鑰
root_password_sha2 = XXX                      #前面生成的登陸密碼
rest_listen_uri = http://127.0.0.1:9000/api/  #必須制定本機IP不能用127.0.0.1因爲會導致外部無法訪問
web_listen_uri = http://127.0.0.1:9000/       #必須制定本機IP不能用127.0.0.1因爲會導致外部無法訪問

啓動graylog，默認日誌保存在/var/log/graylog-server下

/etc/init.d/graylog-server start