Facing issues while setting up graylog multinode environment

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

  1. I am trying to setup Graylog in a multi node cluster environment, 2 GL Node (GL + Mongo DB) and 3 Elastic node

  2. I have created mongodb replicaset in 1 node only

  3. Elastic search running in 3 node

  4. Trying to start graylog in node-1 but it is not starting

 systemctl status graylog-server.service
â graylog-server.service - Graylog server
   Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; disabled; vendor preset: disabled)
   Active: activating (auto-restart) (Result: exit-code) since Sun 2022-07-31 01:31:58 +04; 4s ago
     Docs: http://docs.graylog.org/
  Process: 127823 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
 Main PID: 127823 (code=exited, status=1/FAILURE)

Jul 31 01:31:58 HRC-SOM-dgrayLog07 systemd[1]: Unit graylog-server.service entered failed state.
Jul 31 01:31:58 HRC-SOM-dgrayLog07 systemd[1]: graylog-server.service failed.

*2. Describe your environment: 2 Node GL + Mongo DB , 3 Elastic Search nodes

  • OS Information: Red Hat Enterprise Linux Server release 7.7 (Maipo)

  • Package Version:
    Mongo :


Graylog :


Elastic :


lasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vend                                                                                        or preset: disabled)
  Drop-In: /etc/systemd/system/elasticsearch.service.d
   Active: active (running) since Wed 2022-07-27 02:45:52 +04; 3 days ago
     Docs: http://www.elastic.co
 Main PID: 9440 (java)
   CGroup: /system.slice/elasticsearch.service
           ââ9440 /bin/java -Xms32g -Xmx32g -XX:+UseConcMarkSweepGC -XX:CMSIn...
           ââ9692 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x..

mongod.service - MongoDB Database Server
Loaded: loaded (/usr/lib/systemd/system/mongod.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2022-07-31 00:36:52 +04; 1h 18min ago
Docs: https://docs.mongodb.org/manual
Process: 121982 ExecStart=/usr/bin/mongod $OPTIONS (code=exited, status=0/SUCCESS)
Process: 121979 ExecStartPre=/usr/bin/chmod 0755 /var/run/mongodb (code=exited, status=0/SUCCESS)
Process: 121976 ExecStartPre=/usr/bin/chown mongod:mongod /var/run/mongodb (code=exited, status=0/SUCCESS)
Process: 121973 ExecStartPre=/usr/bin/mkdir -p /var/run/mongodb (code=exited, status=0/SUCCESS)
Main PID: 121984 (mongod)
CGroup: /system.slice/mongod.service
ââ121984 /usr/bin/mongod -f /etc/mongod.conf

Jul 31 00:36:51 HRC-SOM-dgrayLog07 systemd[1]: Starting MongoDB Database Server…
Jul 31 00:36:51 HRC-SOM-dgrayLog07 mongod[121982]: about to fork child process, waiting until server is ready for connections.
Jul 31 00:36:51 HRC-SOM-dgrayLog07 mongod[121982]: forked process: 121984
Jul 31 00:36:52 HRC-SOM-dgrayLog07 mongod[121982]: child process started successfully, parent exiting
Jul 31 00:36:52 HRC-SOM-dgrayLog07 systemd[1]: Started MongoDB Database Server.

  • Service logs, configurations, and environment variables:

No logs are available as this is first time I am trying to bring the service online for Graylog

3. What steps have you already taken to try and solve the problem?

I have validated the graylog configuration files which looks good.

4. How can the community help?

I will answer the question which is being posted by fellow Graylog users

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

All of your services status you have posted show the service as disabled?

Maybe check /var/log/messages to see if anything comes up there about starting the service, also using journalctl to find more detail on why the service didn’t start?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.