Facing issues while setting up graylog multinode environment

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

  1. I am trying to setup Graylog in a multi node cluster environment, 2 GL Node (GL + Mongo DB) and 3 Elastic node

  2. I have created mongodb replicaset in 1 node only

  3. Elastic search running in 3 node

  4. Trying to start graylog in node-1 but it is not starting

 systemctl status graylog-server.service
â graylog-server.service - Graylog server
   Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; disabled; vendor preset: disabled)
   Active: activating (auto-restart) (Result: exit-code) since Sun 2022-07-31 01:31:58 +04; 4s ago
     Docs: http://docs.graylog.org/
  Process: 127823 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
 Main PID: 127823 (code=exited, status=1/FAILURE)

Jul 31 01:31:58 HRC-SOM-dgrayLog07 systemd[1]: Unit graylog-server.service entered failed state.
Jul 31 01:31:58 HRC-SOM-dgrayLog07 systemd[1]: graylog-server.service failed.

*2. Describe your environment: 2 Node GL + Mongo DB , 3 Elastic Search nodes

  • OS Information: Red Hat Enterprise Linux Server release 7.7 (Maipo)

  • Package Version:
    Mongo :

mongodb-org-shell-4.4.9-1.el7.x86_64
mongodb-org-database-tools-extra-4.4.9-1.el7.x86_64
mongodb-org-server-4.4.9-1.el7.x86_64
mongodb-org-tools-4.4.9-1.el7.x86_64
mongodb-org-4.4.9-1.el7.x86_64
mongodb-org-mongos-4.4.9-1.el7.x86_64
mongodb-database-tools-100.5.2-1.x86_64

Graylog :

graylog-server-4.2.7-1.noarch
graylog-integrations-plugins-4.2.7-1.noarch
graylog-enterprise-plugins-4.2.7-1.noarch
graylog-enterprise-integrations-plugins-4.2.7-1.noarch
graylog-4.2-repository-1-4.noarch

Elastic :

elasticsearch-6.8.23-1.noarch

lasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vend                                                                                        or preset: disabled)
  Drop-In: /etc/systemd/system/elasticsearch.service.d
           ââoverride.conf
   Active: active (running) since Wed 2022-07-27 02:45:52 +04; 3 days ago
     Docs: http://www.elastic.co
 Main PID: 9440 (java)
   CGroup: /system.slice/elasticsearch.service
           ââ9440 /bin/java -Xms32g -Xmx32g -XX:+UseConcMarkSweepGC -XX:CMSIn...
           ââ9692 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x..

mongod.service - MongoDB Database Server
Loaded: loaded (/usr/lib/systemd/system/mongod.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2022-07-31 00:36:52 +04; 1h 18min ago
Docs: https://docs.mongodb.org/manual
Process: 121982 ExecStart=/usr/bin/mongod $OPTIONS (code=exited, status=0/SUCCESS)
Process: 121979 ExecStartPre=/usr/bin/chmod 0755 /var/run/mongodb (code=exited, status=0/SUCCESS)
Process: 121976 ExecStartPre=/usr/bin/chown mongod:mongod /var/run/mongodb (code=exited, status=0/SUCCESS)
Process: 121973 ExecStartPre=/usr/bin/mkdir -p /var/run/mongodb (code=exited, status=0/SUCCESS)
Main PID: 121984 (mongod)
CGroup: /system.slice/mongod.service
ââ121984 /usr/bin/mongod -f /etc/mongod.conf

Jul 31 00:36:51 HRC-SOM-dgrayLog07 systemd[1]: Starting MongoDB Database Server…
Jul 31 00:36:51 HRC-SOM-dgrayLog07 mongod[121982]: about to fork child process, waiting until server is ready for connections.
Jul 31 00:36:51 HRC-SOM-dgrayLog07 mongod[121982]: forked process: 121984
Jul 31 00:36:52 HRC-SOM-dgrayLog07 mongod[121982]: child process started successfully, parent exiting
Jul 31 00:36:52 HRC-SOM-dgrayLog07 systemd[1]: Started MongoDB Database Server.

  • Service logs, configurations, and environment variables:

No logs are available as this is first time I am trying to bring the service online for Graylog

3. What steps have you already taken to try and solve the problem?

I have validated the graylog configuration files which looks good.

4. How can the community help?

I will answer the question which is being posted by fellow Graylog users

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

All of your services status you have posted show the service as disabled?

Maybe check /var/log/messages to see if anything comes up there about starting the service, also using journalctl to find more detail on why the service didn’t start?