Graylog

Graylog es un servidor syslog tiene un frontend y funcion con Elasticsearch y MongoDB

mas informacion aca

http://docs.graylog.org/en/latest/index.html

Instalamos los prerequisitos

Instalamos Java
yum install -y java-1.8.0-openjdk

Aplicativo pwgen usado mas adelante
yum install pwgen


Instalamos Mongodb

Agregamos el repositorio

vim /etc/yum.repos.d/mongodb-org-3.4.repo

[mongodb-org-3.4]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.4/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-3.4.asc 

yum install -y mongodb-org

Instalacion de elasticsearch

Agregamos el repositorio
vim /etc/yum.repos.d/elasticsearch.repo

[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

yum install elasticsearch -y

Modificamos el archivo

/etc/elasticsearch/elasticsearch.yml

cluster.name: graylog
network.host: IP
http.port: 9200

Luego iniciamos el servicio

systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl restart elasticsearch.service

Validamos el funcionamiento

curl -X GET http://IP:9200
Y obtendremos

{
  "name" : "kF_bX2i",
  "cluster_name" : "graylog",
  "cluster_uuid" : "iWSBIhw4S6us8PNS7_vpWw",
  "version" : {
    "number" : "5.5.0",
    "build_hash" : "260387d",
    "build_date" : "2017-06-30T23:16:05.735Z",
    "build_snapshot" : false,
    "lucene_version" : "6.6.0"
  },
  "tagline" : "You Know, for Search"
}


Vamos a los paquets
https://packages.graylog2.org/packages

Descargamos la ultima version
https://www.graylog.org/blog/96-announcing-graylog-v2-3-0-rc-1

rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-2.3-repository_latest.rpm

yum clean all

yum install graylog-server 

Una vez instalado hay que modificar el archivo /etc/graylog/server/server.conf

para el valor password_secret 

como indican usamos pwgen

# Generate one by using for example: pwgen -N 1 -s 96   

para el valor root_password_sha2

usamos esto: echo -n tuclave | sha256sum

la clave generada lo colocamos en la variable root_password_sha2 = 

para el valor rest_listen_uri 

ponemos la ip del servidor

rest_listen_uri = http://IP:9000/api/

para el valor web_listen_uri 

ponemos la ip del servidor

web_listen_uri = http://IP:9000/ 

para el valor elasticsearch_hosts

ponemos la IP del servidor 

elasticsearch_hosts = http://IP:9200

para el valor root_timezone

root_timezone = America/Lima

Guardamos los cambios y levantamos el servicio

systemctl daemon-reload
systemctl enable graylog-server.service
systemctl start graylog-server.service

Sources:
http://docs.graylog.org/en/latest/pages/installation/operating_system_packages.html
http://docs.graylog.org/en/latest/pages/installation/os/centos.html
https://docs.mongodb.com/manual/tutorial/install-mongodb-on-red-hat/
https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html
http://docs.graylog.org/en/latest/pages/installation/manual_setup.html