Graylog and Raspberry PI3

(Alain) #1

hi all,

We are looking for install here, at the office, a “central” Graylog.

Outside, by some of our customers, we have to collect informations but in a small scale each time. Our problem is that the communication between the customer and our office fall down, we loose all the datas.

To prevent this, I’m asking me if Gaylog installed on a Raspberry PI3 by the customers could’nt be an interesting solution, not just because of the costs, but also for the small place needed by a Raspberry.

Thx for your help

(Philipp Ruland) #2

Heyo @abh,

Graylog could be deployed on a RPi 3, but with limited performance.
I never tested that, so my answer would be: Try it and report about it. :slight_smile:

Little hint: The RPi has limited memory. Make sure that you limit Graylog and Elasticsearch in their memory usage to fit into the memory of the RPi (while leaving some space for the OS itself) :slight_smile:


(Alain) #3

Hey @DerPhlipsi and thank’s for your so fast answer !

We ar collecting datas from programmable logic controllers and the information string is very short :
[{"tag":"DO_SIMU[199].1","value":"False","time":"2018-09-05T14:35:09.1189226+02:00"}] for example.

The logical architecture we have is quite simple.

The material architecture is also easy, Micro SD cards can go up to 400Gb.

Of course, the Rasp 3 is shot in memory but I’ld really be interested to test Graylog on such a machine

(Jan Doberstein) #4

the main problem will be that you find the option to run elasticsearch 5.x on the rpi AND Graylog at the same time. You need to look at the memory settings for the JVM (as @DerPhlipsi already wrote)

But we would like to hear your story - success or not.

(Alain) #5

May there be an interest to separate elasticsearch 5.x and Graylog on two separates RPI ?

the interests I see using RPIs are

  • Low energy needs
  • Needs few place, no keyboard, no display
  • The RPI can easily be placed in an industrial environment because he have no fan and so its strong and less fragile even than a low cost PC.

(Jan Doberstein) #6

I know that some of our devs use of clusterhat ( ) but not sure what is running on that.

I have some NUC running without any moving parts - giving a little more power and only a little bigger.

(Philipp Ruland) #7

You could do that. Just remember to limit the RAM allocated to Graylog and Elasticsearch to leave about 128MB of RAM for the OS.


(Alain) #8

Thank you for your answers. I’ll try to get the budget for make a test. It would be the 1st time that RPIs are used here :slight_smile: