Trying to setup a siem for my environment. Can complete setup but seems the webpage ipaddress:9000 will not load. Chrome cannot reach this page. I have nuked the server and started fresh several times with no success. Opensearch page does load ipaddress:9200 with some json info.
Service logs, configurations, and environment variables: Used configuration from graylog documentation page
What steps have you already taken to try and solve the problem?
Originally I had Graylog with ES functional, but for some reason it stopped processing logs and couldn’t get it back up. Admittedly I am new with linux and thought nuking and going with opensearch would be a good learning xp.**
Used both to try to figure out how to setup >>
youtube video on graylog setup and graylog page on ubuntu install both are slightly different. (can’t post the links as it kept giving me errors when tryign to setup this post.)
Services show running (openlog, mongodb, GL)
How can the community help?
I just need to get the GL web interface to work so I can complete configuration. or finish pulling out hair
I have tried binding the device’s actually IP address,
put the 0.0.0.0 address, tried the default port 9000 and other ports each reboot everytime and giving it some time before testingt o make sure fully up. The opensearch 9200 page will populate but nothing on 9000
Yup definitely logged in. A lot of the terminals seem to not let me copy and paste. I guess I could ask you the same and say you could just read the documentation on how it is suppose to be setup and there you go? After not knowing anything about linux and trying to follow along it has been amazing frustrating but thanks for your help. putty seems the only that is letting me copy and paste.
Attempted to do as tmacgbay says and looks like a good command to run to give what yall are asking and from what i can understand it should output the conf file without all the extra noncommented chars out- This seems to freeze putty and no response though.
for http binding I have tried as one example showed me 0.0.0.0:9000
previously when I was using GL with ES I inputted : 9000 and was able to get a connection
(completely reinstall OS since then and now using GL with opensearch)
I was using nano instead of cat - once I did cat then it gave me results…apparently, I can’t copy paste out of a forum when its handed to me on a silver platter…my bad…but hey I learn further the differences.
2023-03-17T14:16:28.663Z INFO [VersionProbe] Elasticsearch is not available. Retry #281
2023-03-17T14:16:33.664Z ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-03-17T14:16:33.664Z INFO [VersionProbe] Elasticsearch is not available. Retry #282
petersc@svr100-graylog:~$ cd /etc/elasticsearch/elasticsearch.yml
-bash: cd: /etc/elasticsearch/elasticsearch.yml: No such file or directory
petersc@svr100-graylog:~$ sudo systemctl status elasticsearch.service
Unit elasticsearch.service could not be found.
Noticed it is trying to use elasticsearch for some reason. Although it doesn’t configured to do so. I m using opensearch.
When I make connections on 9200 it doesn’t show in the log. (the connection will successfully connect to opensearch page)
When I attempt connection on 9000 it doesn’t show in the log. (connection fails as before)
Seams like you have a lot going on. I know oyu dont want to hear this but really need to go back over the documentations.
This port is for Elasticsearch/Opensearch, normally used for API like checking the status, using PUT/DELETE/GET/POST.Port 9000 is for your web UI.
If you install openseach make sure its running, and the status is in Green/ok. Then move on to MongoDb and do the same. Both opensearch/elasticsearch will connect to Graylog using localhost or 127.0.0.1 by default. If you cant reach the Web UI usig this → 10.100.20.201:9000 in your Graylog config. double check your MongoDb logs.