Installing Graylog on a Linux server is one of those admin tasks that sounds scary until you break it into sensible pieces. Graylog is a centralized log management platform that helps you collect, search, filter, alert on, and visualize logs from servers, firewalls, applications, containers, routers, and all the noisy little machines that love producing cryptic text at 2:13 a.m.
If you have ever SSH’d into three servers just to chase one failed login, Graylog is the kind of tool that makes you wonder why you waited so long. Instead of hopping from terminal to terminal like a caffeinated squirrel, you send logs to one place, search them through a web interface, and build alerts before a small issue becomes a full-blown “who changed production?” mystery.
This guide explains how to install Graylog on a Linux server, with practical examples focused on Ubuntu Server 22.04 or 24.04. The same concepts also apply to Debian, RHEL, Rocky Linux, AlmaLinux, and SUSE systems, although package commands and repository URLs may differ. We will cover the Graylog stack, prerequisites, installation steps, configuration, first login, security basics, troubleshooting, and real-world experience tips.
What Is Graylog?
Graylog is a log management and security analytics platform. In plain English, it receives log messages, stores them, indexes them, and gives you a clean interface for searching and analyzing them. You can use it for Linux system logs, SSH login monitoring, web server errors, firewall events, application debugging, compliance review, and basic security operations.
A typical Graylog installation has three major parts:
- Graylog Server: The web interface, API, processing engine, streams, alerts, dashboards, and user management layer.
- MongoDB: The database that stores Graylog metadata, such as users, dashboards, streams, settings, and configuration.
- Graylog Data Node or OpenSearch: The search and storage backend used for indexed log data.
Modern Graylog deployments generally prefer Graylog Data Node because it manages the embedded search backend more directly. Self-managed OpenSearch is still possible, but you must match supported versions carefully. Do not randomly install the newest OpenSearch release and hope Graylog politely adapts. Servers rarely reward optimism.
Before You Install Graylog
Recommended Server Resources
For a small lab or test environment, you can start with 4 CPU cores, 8 GB of RAM, and at least 50 GB of storage. For production, increase those numbers based on your daily log volume. Logs grow quickly, especially once firewalls, web servers, databases, and authentication systems join the party.
Use fast SSD storage whenever possible. Graylog’s search backend performs a lot of disk reads and writes, so slow disks will make searches feel like they are being delivered by carrier pigeon. XFS is commonly recommended for log storage workloads because it handles large files and sustained write activity well.
Supported Linux Distributions
Graylog provides official packages for major Linux server platforms, including Ubuntu, Debian, RHEL-compatible distributions such as Rocky Linux and AlmaLinux, and SUSE Linux Enterprise Server. This article uses Ubuntu examples because Ubuntu Server is common, beginner-friendly, and widely used in cloud environments.
Network Ports to Plan
At minimum, plan for these common ports:
- 9000/TCP: Graylog web interface and API.
- 27017/TCP: MongoDB, usually internal only.
- 8999/TCP: Graylog Data Node API, usually internal only.
- 9200/TCP: OpenSearch HTTP, if using self-managed OpenSearch.
- 1514/TCP or UDP: Common custom syslog input port.
- 12201/TCP or UDP: Common GELF input port.
Do not expose MongoDB, Data Node, or OpenSearch directly to the public internet. Graylog’s web interface should also sit behind proper firewall rules, VPN access, or a reverse proxy with TLS.
Step 1: Update Your Linux Server
Start with a clean server and update the package index. On Ubuntu, run:
Set the server timezone. UTC is usually best for log servers because it avoids confusion when comparing events across regions.
Also confirm that time synchronization is working:
Accurate time matters in log management. A five-minute clock drift can turn incident investigation into a bad detective movie.
Step 2: Install MongoDB
Graylog uses MongoDB for configuration metadata. It does not store the actual log messages in MongoDB, but Graylog cannot run without it.
On Ubuntu 24.04, import the MongoDB 8.0 signing key and add the repository:
If you are using Ubuntu 22.04, replace noble with jammy where appropriate, assuming the MongoDB repository supports your target release.
To prevent accidental major upgrades, hold the package version:
Enable and start MongoDB:
By default, MongoDB listens locally. For a single-server lab, that is fine. For multi-node setups, bind MongoDB only to a private interface, never to a public address.
Step 3: Install the Graylog Repository
Graylog packages are installed through the official package repository. The exact version may change over time, so always verify the latest supported Graylog release before production deployment.
For Graylog 7.1 packages on Ubuntu, the repository installation looks like this:
This makes Graylog packages available to your system package manager. You can now install Graylog Server and Graylog Data Node.
Step 4: Install Graylog Data Node
Graylog Data Node is the recommended search backend path for many current Graylog installations. It helps manage the search layer used to index and query log messages.
Next, configure the Linux virtual memory map count. Search engines such as OpenSearch need a higher vm.max_map_count value.
Generate a secure password secret. This value must be shared between Graylog Server and Data Node.
Copy the output somewhere safe temporarily. Then edit the Data Node configuration file:
Add or update these settings:
For heap size, a common starting point is about half the available system memory, with sensible limits. On an 8 GB lab server, 2g to 4g may be reasonable depending on what else runs on the box. Production sizing should be based on ingestion volume and search needs.
Enable and start the Data Node service:
Step 5: Install Graylog Server
Now install the main Graylog service:
Create the SHA-256 hash for the Graylog root admin password:
Enter the password you want to use for the Graylog root account. Copy the resulting hash. This is not the password itself; it is the value Graylog stores in the configuration file.
Edit the Graylog server configuration:
Find and update these settings:
The http_bind_address value controls where the Graylog web interface listens. For a private server, binding to 0.0.0.0:9000 allows access through the server IP address. In production, limit access with firewall rules or place Graylog behind Nginx, Apache, HAProxy, or a cloud load balancer.
Step 6: Tune Graylog Memory
Open the Graylog default environment file:
Adjust the Java heap settings. For a small lab server, this may be enough:
Keep the minimum and maximum heap values the same. Do not give all system memory to Graylog. MongoDB, Data Node, the kernel, and file cache also need room to breathe. Servers, like humans, become grumpy when deprived of breathing room.
Step 7: Start Graylog
Enable and start the service:
Watch the logs if the service does not come up:
Graylog may require a preflight setup step after the first start. Follow the instructions shown in the server log and web interface. Once completed, open your browser:
Log in with the root user after preflight setup is complete.
Step 8: Open Firewall Rules
If you use UFW on Ubuntu, allow the Graylog web interface only from trusted IP addresses when possible:
For testing only, you may allow access more broadly:
For syslog input on a custom port such as 1514:
Do not open MongoDB or internal search backend ports to the public internet. That is not “convenient access”; that is an invitation to future regret.
Step 9: Create Your First Input
After logging into Graylog, go to System > Inputs. Choose an input type such as Syslog TCP, Syslog UDP, GELF TCP, or GELF UDP.
For Linux servers, a common beginner-friendly setup is Syslog UDP on port 1514. Standard syslog port 514 requires elevated privileges, so many admins use a higher port and forward logs there.
On a client Linux server using rsyslog, create a file such as:
Add this line, replacing the IP address with your Graylog server:
Restart rsyslog:
Back in Graylog, search for incoming messages. If logs appear, congratulations: your Linux server is now telling Graylog all its secrets.
Step 10: Secure Your Graylog Installation
A working Graylog installation is not automatically a secure Graylog installation. Before sending production logs, take time to harden it.
Use TLS
Place Graylog behind a reverse proxy such as Nginx and enable HTTPS with a trusted certificate. This protects login credentials and sensitive log data in transit.
Restrict Access
Only administrators and approved systems should reach Graylog. Limit the web interface to VPN users, private networks, or specific IP addresses. Keep MongoDB and Data Node private.
Create Named Users
Do not let everyone use the root account. Create named users and roles. This makes audits easier and prevents “someone changed the dashboard” from becoming the office’s least fun guessing game.
Plan Retention
Decide how long logs should be stored. Keeping everything forever sounds nice until disk usage grows like a monster in a low-budget sci-fi movie. Configure index sets and retention rules based on legal, security, and operational needs.
Common Graylog Installation Problems
Graylog Will Not Start
Check whether password_secret and root_password_sha2 are set. Graylog will not start correctly without mandatory security values. Then inspect logs with:
No Logs Are Arriving
Confirm the input is running, the firewall allows the input port, and the client is sending logs to the correct IP and protocol. UDP and TCP are not interchangeable. If Graylog listens on UDP 1514 and the client sends TCP 1514, those packets are not “almost right.” They are wrong.
MongoDB Connection Errors
Check MongoDB status:
Confirm the mongodb_uri value in Graylog and Data Node configuration files. For single-server installations, mongodb://127.0.0.1:27017/graylog is usually appropriate.
Slow Searches
Slow searches often mean storage is too slow, heap settings are too low or too high, retention is too large, or the server is under-sized for the ingestion volume. Monitor CPU, memory, disk I/O, and index size before guessing.
Graylog Installation Experience: Practical Lessons From the Server Room
The biggest lesson when installing Graylog on a Linux server is this: do not treat it like a simple web app. Graylog is closer to a small logging ecosystem. It has a database, a search backend, a web interface, background processing, message journals, inputs, streams, alerts, and retention rules. If you install it quickly without planning, it may work beautifully for two days and then collapse under log volume like a folding chair at a family barbecue.
Start by estimating log volume. Even a modest environment can generate more logs than expected. A web server, database server, authentication server, and firewall can easily produce gigabytes per day depending on traffic and verbosity. Debug logs are especially dangerous. They are useful during troubleshooting, but leaving debug mode enabled is like turning on a faucet and then wondering why the bathtub joined the downstairs apartment.
Another practical experience is to keep Graylog’s internal components private. Many first-time installers open ports broadly just to “make it work.” That is understandable during testing, but it becomes risky fast. MongoDB should not be publicly reachable. The search backend should not be publicly reachable. Even the Graylog web interface should be protected with firewall rules, VPN access, single sign-on, or a reverse proxy with TLS.
Use a dedicated disk or volume for log storage when possible. This makes capacity planning easier and prevents logs from filling the root filesystem. A full root disk can break package updates, service restarts, SSH sessions, and your mood. Set monitoring alerts for disk usage before you need them. The best time to configure disk alerts is before Graylog has 2% free space and everyone is asking why searches stopped.
Take notes during installation. Save the Graylog version, MongoDB version, repository package name, server IP address, input ports, heap settings, and retention plan. This sounds boring, but future-you will be grateful. Future-you is tired, probably holding coffee, and does not want to reverse-engineer past-you’s “temporary” configuration decisions.
When creating inputs, use clear naming conventions. Instead of naming an input “Syslog,” call it “Linux Syslog UDP 1514” or “Firewall GELF TCP 12201.” When you have ten inputs later, descriptive names prevent confusion. The same applies to streams, dashboards, and alerts. “Production SSH Failures” is much more useful than “Test Alert 3 Final New.”
Finally, test restoration and upgrades in a non-production environment. Graylog, MongoDB, and the search backend all have version compatibility requirements. Never upgrade major components blindly. Read compatibility notes, snapshot important data, and test the upgrade path first. A logging system is often most valuable during incidents, so you do not want it becoming the incident.
Conclusion
Installing Graylog on your Linux server gives you a powerful foundation for centralized logging, troubleshooting, security monitoring, and operational visibility. The core process is straightforward: prepare the server, install MongoDB, add the Graylog repository, install Data Node, install Graylog Server, configure secrets and passwords, start the services, open only the ports you need, and send your first logs.
The real success comes after installation. Secure the web interface, protect internal services, tune memory carefully, plan storage retention, and organize inputs and dashboards in a way humans can understand. Graylog can turn log chaos into searchable clarity, but only if you give it a clean foundation. Treat it well, and it will reward you with fewer mystery outages and fewer midnight terminal adventures.
