Changing Log Locations

[blaholdvelocity (Andrew)]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
Hello! I am looking to change the log location to another drive on my server.
I have mounted an additional HDD (/mnt/sdb)

2. Describe your environment:

• OS Information: Ubuntu 24.02

• Package Version: 6.1

• Service logs, configurations, and environment variables:
  I followed these steps to install Graylog, Graylog Data Node and MongoDB.
  Ubuntu Installation: Single Graylog Node

3. What steps have you already taken to try and solve the problem?
I went to /etc/graylog/server/log4j2.xml and modified the storage location and copied over the files but graylog does not run properly when I do this.

changed /var/log/graylog-server/server.log > /mnt/sdb/log/graylog-server/server.log

Default File Locations

4. How can the community help?

Please let me change where logs or bulk of graylog information is saved to a secondary drive.

Thank you!

[Joel_Duffield]

Does that folder have rights for the Graylog user?

[blaholdvelocity (Andrew)]

I’m guessing not since it says root user and root group?

I should run? sudo chown graylogadmin /mnt/sdb/log/graylog-server/server.log

Sorry, I am not very skilled in linux permissions

[blaholdvelocity (Andrew)]

Changed permissions

[blaholdvelocity (Andrew)]

Updated the XML

[blaholdvelocity (Andrew)]

Restarted services and Viewing log file

[Joel_Duffield]

It sounds like Graylog isn’t communicating with datanode, but you did restart them in a weird order, is those last logs still showing up that it cannot find indexer?

[blaholdvelocity (Andrew)]

What’s the proper order to restart them?

Yeah, those logs show up after changing the log location in the XML.

Here’s what the system shows after a reboot

[Joel_Duffield]

I would do mongo, datanode, graylog.

Have a look at the datanode log files and see if anything is in them.

[blaholdvelocity (Andrew)]

Awesome, thank you for the suggestion!

Is this the correct path?

[Joel_Duffield]

That should be where it is.