Showing posts with label logging. Show all posts
Showing posts with label logging. Show all posts

Thursday, 5 October 2017

Get graylog running on port 80 instead of 9000

If you are building a single service server (and if you are doing anything with log files the chances are that you are... then you might want to get Graylog working on a convenient port, like 80 rather than the default 9000.

By default ports below 1024 are privileged and normal applications are not allowed to run on them.

If you search the internet there are loads of conversations about how to do it the right way... well that is too complicated for me, so here's a quick and dirty way to get it set up.

Just run the service using the root user rather than the graylog user - yeah I know, all kinds of a bad idea if this is externally facing, but if it's internal then I think it'll be alright.

In Ubuntu:

sudo vim /etc/graylog/server/server.conf

Change the port number for rest_listen_uri and web_listen_uri to 80

sudo vim  /usr/lib/systemd/system/graylog-server.service

Change
User=graylog to User=root
Group=graylog to Group=root

Exit and run
systemctl deamon-reload
to apply the changes you just made




Wednesday, 21 December 2016

Static addresses with Graylog

Graylog is a great tool for storing your syslog data.
Even better, they provide a virtual appliance to simplify downloading.
Probably the first thing you will want to do is give it a static IP address (as most network devices don't allow you to use a name as a syslog destination).

So first log on to the console and:
vim /etc/network/interfaces

change 

iface eth0 inet dhcp

to

iface eth0 inet static
    address 10.0.0.41
    netmask 255.255.255.0
    network 10.0.0.0
    broadcast 10.0.0.255
    gateway 10.0.0.1
    dns-nameservers 10.0.0.1 8.8.8.8
    dns-domain acme.com
    dns-search acme.com

Using your IP addresses obviously!

exit, and run:

ifdown eth0
ifup eth0

to restart networking with the new settings.

Now you need to tell graylog that things have changed, so just run 

sudo graylog-ctl reconfigure

This will go through all the settings and ensure it works with the new IP address