Deploying Graylog on a

Configuration

After installing all components, Graylog needs to be properly configured so that it can interact with MongoDB, OpenSearch, and be accessible via the web interface.

1. Basic Graylog Configuration

The main Graylog configuration file is located at /etc/graylog/server/server.conf. Open it for editing:

sudo nano /etc/graylog/server/server.conf

In this file, several critically important parameters need to be changed:

• password_secret: Generates a unique secret key. This is very important for security. Use the command pwgen -N 96 -s 0 to create a long random key.
• root_password_sha2: SHA-256 hash of the password for the admin user in the Graylog web interface. Generate it using the command echo -n "your_password" | sha256sum. Replace your_password with the desired administrator password.
• root_email: Administrator's email (optional, but useful).
• root_timezone: Time zone for the admin user. For example, Europe/Moscow.
• http_bind_address: The IP address on which Graylog will listen for incoming connections for the web interface. Set it to 127.0.0.1:9000, as we will use Caddy to proxy requests and add HTTPS.
• http_external_uri: The full URL by which Graylog will be accessible externally. This will be your domain with HTTPS, for example, https://graylog.example.com/.
• opensearch_hosts: List of OpenSearch hosts. Since it is installed locally, specify http://localhost:9200.
• mongodb_uri: URI for connecting to MongoDB. Default is mongodb://localhost:27017/graylog.

Example changes in server.conf:

# ...
password_secret = [GENERATED_96_CHARACTER_SECRET]
root_password_sha2 = [YOUR_ADMIN_PASSWORD_HASH]
root_email = "[email protected]"
root_timezone = "Europe/Moscow"
# ...
http_bind_address = 127.0.0.1:9000 # Graylog will listen locally
http_publish_uri = http://127.0.0.1:9000/
http_external_uri = https://graylog.example.com/ # YOUR DOMAIN WITH HTTPS
# ...
opensearch_hosts = http://localhost:9200
# ...
# mongodb_uri = mongodb://localhost:27017/graylog # Usually the default is suitable
# ...

After making changes, save the file. Start and enable Graylog:

sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl status graylog-server.service

Wait for Graylog to start. This may take a few minutes.

2. Configuring TLS/HTTPS with Caddy

For secure access to the Graylog web interface, we will use Caddy – a modern web server with automatic HTTPS. Caddy automatically obtains and renews SSL certificates from Let's Encrypt.

Installing Caddy:

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy -y

Caddy Configuration:

Create or edit the Caddyfile:

sudo nano /etc/caddy/Caddyfile

Add the following configuration (replace graylog.example.com with your domain):

graylog.example.com {
    reverse_proxy 127.0.0.1:9000
    # WebSocket settings (if needed, Graylog uses WebSockets)
    header_up Host {host}
    header_up X-Real-IP {remote_host}
    header_up X-Forwarded-Proto {scheme}
    header_up X-Forwarded-For {remote_host}
}

Save the file. Ensure that your domain graylog.example.com points to your VPS's IP address in DNS records (A-record).

Restart Caddy to apply changes:

sudo systemctl enable caddy
sudo systemctl restart caddy
sudo systemctl status caddy

Caddy will automatically obtain an SSL certificate. If issues arise, check Caddy logs (sudo journalctl -u caddy --no-pager) and ensure your domain is correctly configured in DNS and accessible from the internet.

3. Opening Firewall Ports

Now that Graylog and Caddy are configured, you need to open the corresponding ports in UFW.

• 9000/tcp: For direct access to Graylog (but we are using Caddy, so this port can be left closed externally).
• 80/tcp and 443/tcp: For Caddy (HTTP and HTTPS).
• 12201/udp and 12201/tcp: Standard port for Graylog GELF (Graylog Extended Log Format) UDP/TCP.
• 514/udp and 514/tcp: For Syslog UDP/TCP.
• 5044/tcp: For Beats (Filebeat, Metricbeat, etc.).

Add the necessary rules to UFW. To start, let's open ports for Caddy and GELF:

sudo ufw allow 80/tcp # For Caddy (http)
sudo ufw allow 443/tcp # For Caddy (https)
sudo ufw allow 12201/udp # For GELF UDP input
sudo ufw allow 12201/tcp # For GELF TCP input
sudo ufw reload # Reload UFW rules
sudo ufw status # Check UFW status

Add other ports as needed, depending on which log sources you will be using.

4. Verifying Functionality

Open your browser and go to https://graylog.example.com/ (replace with your domain). You should see the Graylog login page. Log in with the username admin and the password you set using root_password_sha2.

After logging in, check under "System" -> "Nodes" that your Graylog server is running and functioning correctly. Also, ensure that you can create a new GELF UDP Input under "System" -> "Inputs" and that it starts successfully.

Backups and Maintenance

Backup is a critically important part of any production system. Graylog stores its data in MongoDB (configuration, metadata) and OpenSearch (the logs themselves). It is important to regularly back up both components.

1. What to Back Up

• MongoDB Database: Contains all Graylog configuration, streams, dashboards, alerts, users, and metadata. This is the most important component for restoring Graylog to a working state.
• Graylog Configuration Files: /etc/graylog/server/server.conf.
• OpenSearch Data: The logs themselves. In most cases, this data can be lost without critical damage to Graylog's functionality (you will simply lose log history), but for auditing or deep analysis, they can be indispensable. OpenSearch backups can be very large.

2. MongoDB Backup

MongoDB can be backed up using the mongodump utility. It is recommended to perform a backup with the Graylog server shut down to ensure data consistency, but for smaller systems, a "hot" backup can be performed.

# Create a directory for backups
sudo mkdir -p /var/backups/mongodb

# Perform a backup of the Graylog database
sudo mongodump --db graylog --out /var/backups/mongodb/$(date +%Y%m%d%H%M%S)

# Or backup all databases (if Graylog is not the only one)
# sudo mongodump --out /var/backups/mongodb/$(date +%Y%m%d%H%M%S)

3. Configuration File Backup

Simply copy the Graylog configuration file:

sudo cp /etc/graylog/server/server.conf /var/backups/graylog_server_conf_$(date +%Y%m%d%H%M%S).conf

4. OpenSearch Data Backup

OpenSearch backup is best done using the Snapshot API. This requires registering a snapshot repository (e.g., on NFS, S3, or locally) and then creating snapshots. Local repository:

# Create a directory for OpenSearch snapshots
sudo mkdir -p /var/backups/opensearch_snapshots
sudo chown opensearch:opensearch /var/backups/opensearch_snapshots

# Register the repository (performed via OpenSearch API)
curl -X PUT "http://localhost:9200/_snapshot/my_backup_repository" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "/var/backups/opensearch_snapshots"
  }
}'

# Create a snapshot of all indices
curl -X PUT "http://localhost:9200/_snapshot/my_backup_repository/snapshot_$(date +%Y%m%d%H%M%S)?wait_for_completion=true"

For automation, you can use a script and cron.

5. Simple Auto-Backup Script (cron + rsync)

Create the script /usr/local/bin/graylog_backup.sh:

#!/bin/bash

BACKUP_DIR="/var/backups/graylog"
TIMESTAMP=$(date +%Y%m%d%H%M%S)
MONGODB_BACKUP_PATH="$BACKUP_DIR/mongodb/$TIMESTAMP"
CONFIG_BACKUP_PATH="$BACKUP_DIR/configs"
OPENSEARCH_SNAPSHOT_REPO="my_backup_repository"

mkdir -p "$MONGODB_BACKUP_PATH"
mkdir -p "$CONFIG_BACKUP_PATH"

echo "Starting Graylog backup at $TIMESTAMP..."

# Backup MongoDB
echo "  Backing up MongoDB..."
sudo mongodump --db graylog --out "$MONGODB_BACKUP_PATH"
if [ $? -eq 0 ]; then
    echo "  MongoDB backup successful."
else
    echo "  MongoDB backup FAILED."
fi

# Backup Graylog config
echo "  Backing up Graylog server.conf..."
sudo cp /etc/graylog/server/server.conf "$CONFIG_BACKUP_PATH/server.conf.$TIMESTAMP"
if [ $? -eq 0 ]; then
    echo "  Graylog config backup successful."
else
    echo "  Graylog config backup FAILED."
fi

# Create OpenSearch snapshot
echo "  Creating OpenSearch snapshot..."
curl -X PUT "http://localhost:9200/_snapshot/$OPENSEARCH_SNAPSHOT_REPO/snapshot_$TIMESTAMP?wait_for_completion=true"
if [ $? -eq 0 ]; then
    echo "  OpenSearch snapshot successful."
else
    echo "  OpenSearch snapshot FAILED."
fi

echo "Graylog backup finished."

# Deleting old backups (e.g., older than 7 days)
find "$BACKUP_DIR/mongodb/" -type d -mtime +7 -exec rm -rf {} +
find "$CONFIG_BACKUP_PATH/" -type f -mtime +7 -name "server.conf." -delete
# For OpenSearch snapshots, you need to use the OpenSearch API to delete old snapshots
# curl -X DELETE "http://localhost:9200/_snapshot/$OPENSEARCH_SNAPSHOT_REPO/snapshot_TO_DELETE"

sudo chmod +x /usr/local/bin/graylog_backup.sh

sudo crontab -e

0 3    /usr/local/bin/graylog_backup.sh >> /var/log/graylog_backup.log 2>&1

6. Where to Store Backups

Storing backups on the same server as the production system is highly discouraged. In the event of a VPS hardware failure or server compromise, you will lose both data and backups. Recommended options:

• External S3-compatible storage: Cloud services such as AWS S3, Backblaze B2, DigitalOcean Spaces. You can use s3cmd or rclone for automatic synchronization of local backups with the cloud.
• Separate VPS or NAS: If you have another server, you can configure rsync over SSH to copy backups.
• BorgBackup or Restic: These utilities allow you to create incremental, deduplicated, and encrypted backups that can be sent to remote storage.

7. Updates: Rolling vs. Maintenance Window

Updating Graylog and its components (OpenSearch, MongoDB, Java) should be done with caution. Always read the official update documentation for each version.

• Graylog: Usually requires service stoppage. It is recommended to plan a "maintenance window" for updates.
• OpenSearch: For a single-node installation, service stoppage is also required. Rolling updates are possible in cluster configurations.
• MongoDB: Minor version updates usually do not require long downtimes, but major versions may also require a maintenance window.
• Java: Can usually be updated without stopping other services, but restarting Graylog and OpenSearch after a Java update is good practice.

Always perform full backups before any major update!

Troubleshooting + FAQ

Graylog does not start or the web interface is inaccessible. What to do?

First, check Graylog logs: sudo journalctl -u graylog-server --no-pager. The most common reasons are: incorrectly configured password_secret or root_password_sha2, connection issues with MongoDB or OpenSearch, incorrectly specified http_bind_address or http_external_uri. Ensure that MongoDB and OpenSearch are running and accessible (sudo systemctl status mongod, sudo systemctl status opensearch, curl http://localhost:9200). Check the UFW firewall, ensure that Caddy (if used) is working and correctly proxying requests.

OpenSearch does not start or Graylog does not see it.

Check OpenSearch logs: sudo journalctl -u opensearch --no-pager. Ensure that sufficient RAM (JVM heap size) is allocated – by default, OpenSearch tries to use up to half of the available RAM. If RAM is low, this can lead to failures. Check the /etc/opensearch/opensearch.yml file for correct network.host (should be localhost for Graylog on the same server) and cluster.name. Ensure that port 9200 is locally accessible.

I don't see logs in Graylog after configuring an Input.

Check that the Input in Graylog is active and running ("System" -> "Inputs"). Ensure that the Input's port (e.g., 12201 for GELF) is open in the UFW firewall on your VPS. Verify that the log source (e.g., Filebeat, your service) is configured to send logs to the correct IP address of your VPS and the Graylog port. Use tcpdump or netcat on the VPS to check if packets are arriving on the correct port (e.g., sudo tcpdump -i any port 12201).

How to update Graylog to a new version?

Always read the official Graylog upgrade guide for your specific version. The general process includes stopping the Graylog server, upgrading the Graylog package via apt upgrade graylog-server, checking and potentially updating configuration files, and then starting Graylog. Always perform a full backup of MongoDB and Graylog configuration before upgrading.

What is the minimum suitable VPS configuration?

For small loads (up to 100-200 messages per second), a minimum VPS with 2-4 vCPU, 8-12 GB RAM, and 100-200 GB SSD storage will be required. However, for comfortable operation and potential for slight growth, it is recommended to aim for 4 vCPU, 16 GB RAM, and 200-500 GB NVMe SSD. The disk must be fast, as OpenSearch is very sensitive to I/O performance.

What to choose — VPS or dedicated for this task?

The choice between VPS and dedicated depends on the volume of logs and the criticality of the system. For most startups, developers, and small teams, a VPS will be an optimal and economical solution. It provides sufficient performance and flexibility. A dedicated server becomes necessary for very high loads (thousands of messages per second), long-term storage of large data volumes (terabytes of logs), or when maximum performance and resource isolation are required. Dedicated servers provide stable performance without "noisy neighbors" and allow for the use of more powerful disk subsystems.

How to configure Graylog to collect logs from remote servers?

To collect logs from remote servers, use agents such as Filebeat, Fluentd, or rsyslog. Filebeat is the most popular choice for Graylog, as it is lightweight and easy to configure. In Graylog, you need to create a corresponding Input (e.g., "Beats Input" for Filebeat). On the remote server, install Filebeat, configure it to read the desired logs, and send them to your Graylog VPS's IP address and the Beats Input port (default 5044/tcp). Don't forget to open this port in UFW on the Graylog VPS.

Conclusions and Next Steps

We have successfully deployed Graylog 6.0 on your VPS, creating a powerful and flexible platform for centralized log collection and analysis. You now have a working system with MongoDB for configuration, OpenSearch for data storage, and Caddy for secure HTTPS access. This is a significant step towards increasing the transparency of your infrastructure and promptly responding to incidents.

Further steps may include integrating Graylog with your existing infrastructure (configuring Filebeat on all your servers), creating dashboards to visualize key metrics, and setting up complex alerts for critical events. For system scaling, consider dedicating OpenSearch to a separate server or configuring an OpenSearch cluster to improve performance and fault tolerance as log volumes grow.