You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
71 lines
1.7 KiB
71 lines
1.7 KiB
# Clone Debian Stretch template, set up IPs, hostname, ssh keys
|
|
apt update
|
|
apt -y dist-upgrade
|
|
|
|
# Install graylog
|
|
# Install deps
|
|
apt -y install apt-transport-https openjdk-8-jre-headless uuid-runtime pwgen
|
|
|
|
# Set up repo:
|
|
wget -q -O - https://packages.graylog2.org/repo/debian/keyring.gpg | apt-key add
|
|
echo "deb https://packages.graylog2.org/repo/debian/ stable 2.4" > /etc/apt/sources.list.d/graylog.list
|
|
# Disable apt cache, comment out proxy in /etc/apt/apt.conf
|
|
apt update
|
|
apt install graylog-server
|
|
|
|
# Set a password:
|
|
echo -n password | sha256sum
|
|
# Set that to in /etc/graylog/server/server.conf:
|
|
password_secret =
|
|
# Set also:
|
|
root_password_sha2 =
|
|
|
|
# Set these:
|
|
rest_listen_uri = http://10.22.22.109:9000/api/
|
|
web_listen_uri = http://10.22.22.109:9000/
|
|
elasticsearch_hosts = http://10.22.22.118:9200
|
|
mongodb_uri = mongodb://10.22.22.119:27017/graylog
|
|
|
|
|
|
|
|
|
|
# Open up firewall:
|
|
-A INPUT -p tcp --dport 9000 -j ACCEPT
|
|
# Syslog UDP
|
|
-A INPUT -p udp --dport 514 -j ACCEPT
|
|
# Syslog UDP alt port
|
|
-A INPUT -p udp --dport 5144 -j ACCEPT
|
|
# Syslog TCP
|
|
-A INPUT -p tcp --dport 514 -j ACCEPT
|
|
# Syslog TCP alt port
|
|
-A INPUT -p tcp --dport 5144 -j ACCEPT
|
|
|
|
|
|
|
|
# Start service:
|
|
systemctl daemon-reload
|
|
systemctl start graylog-server.service
|
|
|
|
# Start on boot:
|
|
systemctl enable graylog-server.service
|
|
|
|
|
|
|
|
### XXX Backups
|
|
### XXX Prometheus :)
|
|
|
|
|
|
# Add clients
|
|
# Add to /etc/rsyslog.d:
|
|
|
|
# UDP (use this):
|
|
echo "*.* @10.22.22.109:5144;RSYSLOG_SyslogProtocol23Format" > /etc/rsyslog.d/graylog.conf
|
|
|
|
# TCP:
|
|
echo "*.* @@10.22.22.109:5144;RSYSLOG_SyslogProtocol23Format" > /etc/rsyslog.d/graylog.conf
|
|
|
|
# Maybe?
|
|
echo 'action(type="omfwd" target="10.22.22.109" port="5144" template="RSYSLOG_SyslogProtocol23Format")' > /etc/rsyslog.d/graylog.conf
|
|
|
|
systemctl restart rsyslog
|