Graylog not displaying in Browser

Graylog Central (peer support)
1

I searched through the forums before creating my post, none of the others seemed to fix my issue.

I just installed Graylog, as per the Debian instructions. And it seems to be running fine, no major errors in the logs apart from some warnings in regards to sun.reflect.Reflection.getCallerClass is not supported.

I modified the server.conf file as laid out, and tried a few small changes here and there to see if it would make a difference, but to no avail. I’ve included the HTTP settings.

###############
# HTTP settings
###############

#### HTTP bind address
#
# The network interface used by the Graylog HTTP interface.
#
# This network interface must be accessible by all Graylog nodes in the cluster and by all clients
# using the Graylog web interface.
#
# If the port is omitted, Graylog will use port 9000 by default.
#
# Default: 127.0.0.1:9000
http_bind_address = 10.0.1.232:9000
#http_bind_address = [2001:db8::1]:9000

#### HTTP publish URI
#
# The HTTP URI of this Graylog node which is used to communicate with the other Graylog nodes in the cluster and by all
# clients using the Graylog web interface.
#
# The URI will be published in the cluster discovery APIs, so that other Graylog nodes will be able to find and connect to this Graylog node.
#
# This configuration setting has to be used if this Graylog node is available on another network interface than $http_bind_address,
# for example if the machine has multiple network interfaces or is behind a NAT gateway.
#
# If $http_bind_address contains a wildcard IPv4 address (0.0.0.0), the first non-loopback IPv4 address of this machine will be used.
# This configuration setting *must not* contain a wildcard address!
#
# Default: http://$http_bind_address/
http_publish_uri = http://10.0.1.232:9000/

When I run the curl commands I get responses that are identical from my home or from another server on the same subnet as the Graylog server. So I don’t believe it’s a firewall issue. But there’s just nothing that appears on my browser, it says connecting, then eventually times out.

curl -i http://52.14.120.6:9000

HTTP/1.1 200 OK
X-UA-Compatible: IE=edge
X-Graylog-Node-ID: c0316656-099f-49b2-8c73-2eba40e59434
Content-Type: text/html
Content-Length: 1940

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="robots" content="noindex, nofollow">
    <meta charset="UTF-8">
    <title>Graylog Web Interface</title>
    <link rel="shortcut icon" href="http://10.0.1.232:9000/assets/favicon.png">
    
  </head>
  <body>
    <script src="http://10.0.1.232:9000/config.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/vendor.594b2a39cb22b445205e.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/polyfill.1342fdbc611eaa2ab131.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/builtins.1342fdbc611eaa2ab131.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.de74ad3eb924a95d9bd6.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/plugin/org.graylog.plugins.enterprise.EnterprisePlugin/plugin.org.graylog.plugins.enterprise.EnterprisePlugin.46058f81f110cde04045.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.1a190e3e93abeadb77d4.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/plugin/org.graylog.integrations.IntegrationsPlugin/plugin.org.graylog.integrations.IntegrationsPlugin.e2bb36e552470f373cd8.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/plugin/org.graylog.enterprise.integrations.EnterpriseIntegrationsPlugin/plugin.org.graylog.enterprise.integrations.EnterpriseIntegrationsPlugin.2451ee933becc9995e46.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.b209435812abfc421726.js"></script>
    
    <script src="http://10.0.1.232:9000/assets/app.1342fdbc611eaa2ab131.js"></script>
    
  </body>
</html>

curl -i http://52.14.120.6:9000/api

HTTP/1.1 200 OK
X-Graylog-Node-ID: c0316656-099f-49b2-8c73-2eba40e59434
X-Runtime-Microseconds: 1556
Content-Type: application/json
Content-Length: 232

{"cluster_id":"5c067cc8-0da5-45df-8616-37366b57ec45","node_id":"c0316656-099f-49b2-8c73-2eba40e59434","version":"4.0.6+40b7be5","tagline":"Manage your logs in the dark and have lasers going and make it look like you're from space!"}
2

Hi @Canadian

from the end you trying to access it via Browser, can you bind “52.14.120.6” in port “9000”?

telnet 52.14.120.6 9000

3

I tested it via telnet as follows,

$ telnet 52.14.120.6 9000
Trying 52.14.120.6...
Connected to 52.14.120.6.
Escape character is '^]'.
Connection closed by foreign host.

For testing purposes I even connected from another host in the same subnet and got the same result. Any ideas?

4

Hi @Canadian

sorry for the question, but your telnet was made in the same local you trying to make this access via browser?

I’m asking because it isn’t clear to me.

If so, when you try to open your graylog via browser, it shows some error message in browser console (F12)?

5

Yes, it’s from the same machine.

Looking at it now, I can see it’s trying to access content from the local IP of the Graylog server, 10.0.1.232, which of course is unreachable.

Once I modified the config file to use the external IP, everything fell into place.

Thanks for your help.

1 Like
6

Ok, thanks for clarify.

How about this question:

7

Oops, sorry, was editing my other reply, and then forgot it was an edit when I posted the fix. :slight_smile:

The error was staring me in the face all along, but by you asking me to look at the errors in the console, it became far more apparent.

1 Like
8

Awesome!

Glad to hear that.

Keep going, stay safe! :facepunch:

1 Like
9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.