這几天進graylog時提示6版已經出來了

看官網說的是可以直接更新

還是先裝一台來試看看好了

這次用的是almalinux 9

6版已經不再支援 elasticsearch 了

依照官網安裝流程裝到opensearch就有問題了

安裝後無法啟動

看了一下 opensearch.yml

裡面有一段 

######## Start OpenSearch Security Demo Configuration ########

# WARNING: revise all the lines below before you go into production

plugins.security.ssl.transport.pemcert_filepath: esnode.pem

plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem

plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem

plugins.security.ssl.transport.enforce_hostname_verification: false

plugins.security.ssl.http.enabled: true

plugins.security.ssl.http.pemcert_filepath: esnode.pem

plugins.security.ssl.http.pemkey_filepath: esnode-key.pem

plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem

plugins.security.allow_unsafe_democertificates: true

plugins.security.allow_default_init_securityindex: true

plugins.security.authcz.admin_dn: ['CN=kirk,OU=client,O=client,L=test,C=de']

plugins.security.audit.type: internal_opensearch

plugins.security.enable_snapshot_restore_privilege: true

plugins.security.check_snapshot_restore_write_privileges: true

plugins.security.restapi.roles_enabled: [all_access, security_rest_api_access]

plugins.security.system_indices.enabled: true

plugins.security.system_indices.indices: [.plugins-ml-agent, .plugins-ml-config, .plugins-ml-connector,

  .plugins-ml-controller, .plugins-ml-model-group, .plugins-ml-model, .plugins-ml-task,

  .plugins-ml-conversation-meta, .plugins-ml-conversation-interactions, .plugins-ml-memory-meta,

  .plugins-ml-memory-message, .plugins-ml-stop-words, .opendistro-alerting-config,

  .opendistro-alerting-alert*, .opendistro-anomaly-results*, .opendistro-anomaly-detector*,

  .opendistro-anomaly-checkpoints, .opendistro-anomaly-detection-state, .opendistro-reports-*,

  .opensearch-notifications-*, .opensearch-notebooks, .opensearch-observability, .ql-datasources,

  .opendistro-asynchronous-search-response*, .replication-metadata-store, .opensearch-knn-models,

  .geospatial-ip2geo-data*, .plugins-flow-framework-config, .plugins-flow-framework-templates,

  .plugins-flow-framework-state]

node.max_local_storage_nodes: 3

######## End OpenSearch Security Demo Configuration ########

感覺是這段的問題

備分後重新開一個新的 opensearch.yml

裡面的內容只要以下這些就好

cluster.name: graylog

node.name: ${HOSTNAME}

path.data: /var/lib/opensearch

path.logs: /var/log/opensearch

discovery.type: single-node

network.host: 0.0.0.0

action.auto_create_index: false

plugins.security.disabled: true

indices.query.bool.max_clause_count: 32768

改完後啟動就沒問題了

跟之前不同 graylog這個版本安裝好後

打開 http://127.0.0.1:9000 無法進到web介面 

看了一下 /var/log/graylog-server/server.log

It seems you are starting Graylog for the first time. To set up a fresh install, a setup interface has

been started. You must log in to it to perform the initial configuration and continue.

Initial configuration is accessible at 0.0.0.0:9000, with username 'admin' and password 'iIcCiFzjWY'.

Try clicking on http://admin:iIcCiFzjWY@0.0.0.0:9000

需要先 Initial configuration 才能使用

進入後依照畫面的步驟設定後 就能進入graylog的介面了

Memory/Heap usage 預設是1G 要再調整

/etc/sysconfig/graylog-server

GRAYLOG_SERVER_JAVA_OPTS="-Xms1g -Xmx1g -server -XX:+UseG1GC -XX:-OmitStackTraceInFastThrow"

依ram大小調整

https://go2docs.graylog.org/current/upgrading_graylog/upgrading_graylog.html

https://go2docs.graylog.org/current/downloading_and_installing_graylog/installing_graylog.html