I’ve been running Graylog2 in production for 1-2 years now, on a simple setup with 2x VMs. One runs GL + Mongo, the other is the singular ES node.
Another department is moving to ‘the cloud’ and I managed to convince them to give my department 3x almost brand new servers, specs are
- 2xE5-2643 v4 (6-core @ 3.4Ghz)
- 512GB DDR4
- 24x 400GB SSD + 2x 800GB HDD.
I’m aware that it’s preferable to have a three node setup for most of the parts. Usually we do everything with VMWare ESXi, but I’m keen to go bare metal to get the most out of the hardware.
How would you set this up? I was thinking of a simple bare-metal OS per server, then each server runs: ES (3-node cluster), MongoDB (3-node replica set), and graylog2.
I would likely be using keepalived between the three servers to hold the logging VIP address, and then whichever server receives the logs would also act as the load balancer to the others. Redundancy is important, so I don’t want to do the load balancing upstream as it means more hardware.
Any thoughts, or advice, appreciated.