Adding Storage to Graylog Ubuntu VM

[SteveFP (Steven Petrillo)]

Hello all,

I am new here and looking forward to using Graylog for my logging needs. I have deployed the OVA with no issues but noticed only a 20 gig partition was allocated. I would like to implement a second partition of 100 gig and move the logs collected to this partition. Is there a document that decribes being able to do this?

Thanks,
Steve

[gsmith]

@SteveFP
Not sure if this still works, and it been a really long time since I used OVA. Have you tried this?

Extend disk space on OVA 3.0

Yeah, all of that is bog-standard Linux. That’ll work just fine, as long as you know what you’re doing. [2un5ke]

[SteveFP (Steven Petrillo)]

Yes that document is old. The directories to copy is not correct.

[gsmith]

@SteveFP
I’m sure that you can expand the partion to your needs.

How to Resize Your Ubuntu Partitions

Other then that Im not to sure I’m sorry, maybe some one else here can help you.

[aaronsachs]

@SteveFP I’ll echo what @gsmith posted. Resizing the partition is going to be a standard linux operation, so that’s a bit outside of the scope of what we’d typically put in the docs. To keep things simple, I’d recommend just expanding the existing partition (it’s LVM, so expanding should be relatively straightforward), unless you’ve got a need to create a separate partition for Elasticsearch data.

[SteveFP (Steven Petrillo)]

Ok maybe I can be a little more specific. I now how to partition and add a new drive, but I would like to just set the new partition up so that message ingestion goes to this new drive. Are there instructions for moving the data directories to the new drive and then configure Graylog to use this new drive?

[dickinsonzach]

Good afternoon, with Graylog using Elastic Search and MongoDB I would think you would need to move where those are. Maybe? Thank you, Zach.

[parag]

Elastic Search stores data in /var/lib/elasticsearch.

If you want to use new volume to store data . e.g /data

• stop es and graylog services. ( e.g systemctl stop elasticsearch.service, systemctl stop graylog-server.service)
• mv -rf /var/lib/elasticsearch /data
• rmdir /var/lib/elasticsearch
• ln -s /data /var/lib/elasticsearch
• chown elasticsearch:elasticsearch /var/lib/elasticsearch
• systemctl stop elasticsearch.service
  systemctl stop graylog.service

[dickinsonzach]

Here are a couple of links I found:

Change data path

Service status - elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Sat 2018-02-03 21:40:11 +06; 1h 6min ago Docs: http://www.elastic.co Process: 15083 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID_DIR}/elasticsearch.pid --quiet -Edefault.path.logs=${LOG_DIR} -Edefault.path.data=${DATA_DIR} -Edefault.path.conf=${CONF_DIR} (code=exited, status…

How to store the input logs in another path

Hello, I don’t know how to store the input logs in another directory. Is it possible to do this ? May i miss it in the documentation ? PS : I installed graylog manually In any case thanks you by advance for your answer and time.

https://docs.graylog.org/en/4.0/pages/configuration/file_location.html

Thank you, Zach.