# Graylog server is not starting **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [April 29, 2021, 4:16am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659 "2021-04-29T04:16:17Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![kesifalaraskey](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@kesifalaraskey](https://community.graylog.org/u/kesifalaraskey)\ **Post date:** [April 29, 2021, 4:16am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/1 "2021-04-29T04:16:17Z")
I have installed step to step from documentation but graylog server is not starting. Mongodb server is also running properly graylog/server.log \> ubuntu@ip-172-31-42-22:~$ tail -f /var/log/graylog-server/server.log > at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) ~[?:1.8.0\_282] > at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) ~[?:1.8.0\_282] > at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) ~[?:1.8.0\_282] > at java.net.Socket.connect(Socket.java:607) ~[?:1.8.0\_282] > at com.mongodb.internal.connection.SocketStreamHelper.initialize(SocketStreamHelper.java:64) ~[graylog.jar:?] > at com.mongodb.internal.connection.SocketStream.initializeSocket(SocketStream.java:79) ~[graylog.jar:?] > at com.mongodb.internal.connection.SocketStream.open(SocketStream.java:65) ~[graylog.jar:?] > … 3 more > 2021-04-29T05:48:53.286Z INFO [connection] Opened connection [connectionId{localValue:15, serverValue:1}] to localhost:27017 > 2021-04-29T05:48:53.287Z INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[4, 0, 24]}, minWireVersion=0, maxWireVersion=7, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=306404} > 2021-04-29T05:51:21.452Z INFO [CmdLineTool] Loaded plugin: AWS plugins 4.0.6 [org.graylog.aws.AWSPlugin] > 2021-04-29T05:51:21.457Z INFO [CmdLineTool] Loaded plugin: Collector 4.0.6 [org.graylog.plugins.collector.CollectorPlugin] > 2021-04-29T05:51:21.458Z INFO [CmdLineTool] Loaded plugin: Threat Intelligence Plugin 4.0.6 [org.graylog.plugins.threatintel.ThreatIntelPlugin] > 2021-04-29T05:51:21.458Z INFO [CmdLineTool] Loaded plugin: Elasticsearch 6 Support 4.0.6+40b7be5 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] > 2021-04-29T05:51:21.460Z INFO [CmdLineTool] Loaded plugin: Elasticsearch 7 Support 4.0.6+40b7be5 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] > 2021-04-29T05:51:21.917Z INFO [CmdLineTool] Running with JVM arguments: -Xms1g -Xmx1g -XX:NewRatio=1 -XX:+ResizeTLAB -XX:-OmitStackTraceInFastThrow -Djdk.tls.acknowledgeCloseNotify=true -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Djava.library.path=/usr/share/graylog-server/lib/sigar -Dgraylog2.installation\_source=deb > 2021-04-29T05:51:22.435Z INFO [Version] HV000001: Hibernate Validator null > 2021-04-29T05:51:28.764Z INFO [InputBufferImpl] Message journal is enabled. > 2021-04-29T05:51:28.793Z INFO [NodeId] Node ID: a55e7341-b246-45e0-9aa9-963b7832aaca > 2021-04-29T05:51:29.285Z INFO [LogManager] Loading logs. > 2021-04-29T05:51:29.321Z WARN [Log] Found a corrupted index file, /var/lib/graylog-server/journal/messagejournal-0/00000000000000000000.index, deleting and rebuilding index… > 2021-04-29T05:51:29.362Z INFO [LogManager] Logs loading complete. > 2021-04-29T05:51:29.368Z INFO [KafkaJournal] Initialized Kafka based journal at /var/lib/graylog-server/journal > 2021-04-29T05:51:29.415Z INFO [cluster] Cluster created with settings {hosts=[localhost:27017], mode=SINGLE, requiredClusterType=UNKNOWN, serverSelectionTimeout=‘30000 ms’, maxWaitQueueSize=5000} > 2021-04-29T05:51:29.487Z INFO [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out > 2021-04-29T05:51:29.542Z INFO [connection] Opened connection [connectionId{localValue:1, serverValue:3}] to localhost:27017 > 2021-04-29T05:51:29.551Z INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[4, 0, 24]}, minWireVersion=0, maxWireVersion=7, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=7460950} > 2021-04-29T05:51:29.577Z INFO [connection] Opened connection [connectionId{localValue:2, serverValue:4}] to localhost:27017 > 2021-04-29T05:51:29.970Z INFO [InputBufferImpl] Initialized InputBufferImpl with ring size \<65536\> and wait strategy , running 2 parallel message handlers. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 29, 2021, 4:32am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/2 "2021-04-29T04:32:21Z")
@kesifalaraskey Hello, Is graylog service not starting or are you unable to log into Graylog web interface? Those logs dont really show me what the problem is. Some more details would be helpful. Thanks ---
**Author:** ![kesifalaraskey](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@kesifalaraskey](https://community.graylog.org/u/kesifalaraskey)\ **Post date:** [April 29, 2021, 4:34am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/3 "2021-04-29T04:34:08Z")
Thank you for your quick response. graylog itself not starting. > ubuntu@ip-172-31-42-22:~$ netstat -nptl > (Not all processes could be identified, non-owned process info > will not be shown, you would have to be root to see it all.) > Active Internet connections (only servers) > Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name > tcp 0 0 127.0.0.53:53 0.0.0.0:\* LISTEN - > tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN - > tcp 0 0 127.0.0.1:27017 0.0.0.0:\* LISTEN - > tcp6 0 0 :::22 :::\* LISTEN - ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 29, 2021, 4:41am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/4 "2021-04-29T04:41:01Z")
Ok, Going to ask you a few question. Can you execute this command and what does it show you? Do you see any errors? > systemctl status graylog-server What do you see when you execute this? > curl -XGET ‘[http://localhost:9200/\_cluster/health?pretty=true](http://localhost:9200/_cluster/health?pretty=true)’ ---
**Author:** ![kesifalaraskey](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@kesifalaraskey](https://community.graylog.org/u/kesifalaraskey)\ **Post date:** [April 29, 2021, 4:44am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/5 "2021-04-29T04:44:04Z")
> [@gsmith](#): > > systemctl status graylog-server > ubuntu@ip-172-31-42-22:~$ systemctl status graylog-server > ● graylog-server.service - Graylog server > Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled) > Active: active (running) since Thu 2021-04-29 04:26:50 UTC; 14min ago > Docs: [http://docs.graylog.org/](http://docs.graylog.org/) > Main PID: 1168 (graylog-server) > Tasks: 19 (limit: 1160) > Memory: 623.3M > CGroup: /system.slice/graylog-server.service > ├─1168 /bin/sh /usr/share/graylog-server/bin/graylog-server > └─1202 /usr/bin/java -Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:-OmitStackTraceInFastThrow -Djdk.tls.acknowledgeCloseNotify=true -XX:+UseParNewGC -XX:+UseConcMarkSw\> > > Apr 29 04:26:50 ip-172-31-42-22 systemd[1]: Stopped Graylog server. > Apr 29 04:26:50 ip-172-31-42-22 systemd[1]: Started Graylog server. I am using aws elasticsearch and on curl it is responsing > { > “name” : “121…2db”, > “cluster\_name” : “2…:p…”, > “cluster\_uuid” : “0.\_…g”, > “version” : { > “number” : “x.xx.x-SNAPSHOT”, > “build\_flavor” : “oss”, > “build\_type” : “tar”, > “build\_hash” : “unknown”, > “build\_date” : “2021-03-10T10:58:06.207203Z”, > “build\_snapshot” : true, > “lucene\_version” : “8.7.0”, > “minimum\_wire\_compatibility\_version” : “6.8.0”, > “minimum\_index\_compatibility\_version” : “6.0.0-beta1” > }, > “tagline” : “You Know, for Search” > } ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 29, 2021, 4:54am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/6 "2021-04-29T04:54:13Z")
@kesifalaraskey > [@kesifalaraskey](#): > > Active: active (running) since Thu 2021-04-29 04:26:50 UTC; 14min ago Looks like Graylog service is running. Sorry I’m not familiar with AWS elasticsearch. Only suggetion I could give you is check you firewall make sure the correct ports are opened and look through MongoDb, Elasticsearch and Graylog server log files. Maybe something in there can tell you the problem. If you could post where you got your instruction from and how you configured you graylog configuration file. Someone here might be able to help you further. If your unsure what to post take a look at this. [https://community.graylog.org/t/community-guidelines/6649#details](https://community.graylog.org/t/community-guidelines/6649#details) ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 29, 2021, 4:56am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/7 "2021-04-29T04:56:30Z")
@kesifalaraskey I just seen the bottom of your post, I’m sorry. Maybe try this instead > curl -XGET ‘[http://127.0.0.1:9200/\_cluster/health?pretty=true’](http://127.0.0.1:9200/_cluster/health?pretty=true%E2%80%99) You should see something like this. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0613e6adc023b49aaaa64718d25b43c33287cc50.png) ---
**Author:** ![kesifalaraskey](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@kesifalaraskey](https://community.graylog.org/u/kesifalaraskey)\ **Post date:** [April 29, 2021, 5:02am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/8 "2021-04-29T05:02:30Z")
Server.conf > is\_master = true > node\_id\_file = /etc/graylog/server/node-id > password\_secret =kNImNQozKstySv…r5vP0BI1hHvuTCYDqnptkzU > root\_password\_sha2 =433fce394f…f40cbb > bin\_dir = /usr/share/graylog-server/bin > data\_dir = /var/lib/graylog-server > plugin\_dir = /usr/share/graylog-server/plugin > http\_bind\_address : 127.0.0.1:9000(default) > elasticsearch\_hosts = ElasticEndpoint mostly all thinks are default ---
**Author:** ![kesifalaraskey](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@kesifalaraskey](https://community.graylog.org/u/kesifalaraskey)\ **Post date:** [April 29, 2021, 5:11am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/9 "2021-04-29T05:11:12Z")
> [@gsmith](#): > > \_cluster/health?pretty=true’ > { > “cluster\_name”:“2…7:p…”, > “status”:“yellow”, > “timed\_out”:false, > “number\_of\_nodes”:1, > “number\_of\_data\_nodes”:1, > “discovered\_master”:true, > “active\_primary\_shards”:12, > “active\_shards”:12, > “relocating\_shards”:0, > “initializing\_shards”:0, > “unassigned\_shards”:10, > “delayed\_unassigned\_shards”:0, > “number\_of\_pending\_tasks”:0, > “number\_of\_in\_flight\_fetch”:0, > “task\_max\_waiting\_in\_queue\_millis”:0, > “active\_shards\_percent\_as\_number”:54.54545454545454 > } Get yellow status and also if elastic search have problem than also server can start ? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 29, 2021, 5:16am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/10 "2021-04-29T05:16:31Z")
> [@kesifalaraskey](#): > > “status”:“yellow”, Even thou its yellow , you should be able to log into the Graylog’s Web UI. > [@kesifalaraskey](#): > > http\_bind\_address : 127.0.0.1:9000(default) Try using this and restart graylog service. > http\_bind\_address: 0.0.0.0:9000 > [@kesifalaraskey](#): > > elasticsearch\_hosts = ElasticEndpoint Not sure about that configuration. should look something like this, which I believe is a default config. > elasticsearch\_hosts = [http://127.0.0.1:9200](http://127.0.0.1:9200) ---
**Author:** ![kesifalaraskey](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@kesifalaraskey](https://community.graylog.org/u/kesifalaraskey)\ **Post date:** [April 29, 2021, 5:25am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/11 "2021-04-29T05:25:55Z")
> [@gsmith](#): > > 0.0.0.0:9000 Nothing happen same log return as shown in logs it is not connecting with even mongod ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 29, 2021, 5:27am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/12 "2021-04-29T05:27:09Z")
Ok , Do you have this set in you Graylog config it should be uncommented. > mongodb\_uri = mongodb://localhost/graylog ---
**Author:** ![kesifalaraskey](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@kesifalaraskey](https://community.graylog.org/u/kesifalaraskey)\ **Post date:** [April 29, 2021, 5:30am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/13 "2021-04-29T05:30:44Z")
> [@gsmith](#): > > mongodb://localhost/graylog Nothing change happen. Mongod.logs > 2021-04-29T05:24:03.150+0000 I NETWORK [listener] connection accepted from 127.0.0.1:47900 #4 (1 connection now open) > 2021-04-29T05:24:03.167+0000 I NETWORK [conn4] received client metadata from 127.0.0.1:47900 conn4: { driver: { name: “mongo-java-driver|legacy”, version: “3.12.1” }, os: { type: “Linux”, name: “Linux”, architecture: “amd64”, version: “5.4.0-1038-aws” }, platform: “Java/Private Build/1.8.0\_282-8u282-b08-0ubuntu1~20.04-b08” } > 2021-04-29T05:24:03.229+0000 I NETWORK [listener] connection accepted from 127.0.0.1:47902 #5 (2 connections now open) > 2021-04-29T05:24:03.230+0000 I NETWORK [conn5] received client metadata from 127.0.0.1:47902 conn5: { driver: { name: “mongo-java-driver|legacy”, version: “3.12.1” }, os: { type: “Linux”, name: “Linux”, architecture: “amd64”, version: “5.4.0-1038-aws” }, platform: “Java/Private Build/1.8.0\_282-8u282-b08-0ubuntu1~20.04-b08” } > 2021-04-29T05:28:42.311+0000 I NETWORK [conn5] end connection 127.0.0.1:47902 (1 connection now open) > 2021-04-29T05:28:42.312+0000 I NETWORK [conn4] end connection 127.0.0.1:47900 (0 connections now open) > 2021-04-29T05:28:52.814+0000 I NETWORK [listener] connection accepted from 127.0.0.1:47914 #6 (1 connection now open) > 2021-04-29T05:28:52.831+0000 I NETWORK [conn6] received client metadata from 127.0.0.1:47914 conn6: { driver: { name: “mongo-java-driver|legacy”, version: “3.12.1” }, os: { type: “Linux”, name: “Linux”, architecture: “amd64”, version: “5.4.0-1038-aws” }, platform: “Java/Private Build/1.8.0\_282-8u282-b08-0ubuntu1~20.04-b08” } > 2021-04-29T05:28:52.879+0000 I NETWORK [listener] connection accepted from 127.0.0.1:47916 #7 (2 connections now open) > 2021-04-29T05:28:52.881+0000 I NETWORK [conn7] received client metadata from 127.0.0.1:47916 conn7: { driver: { name: “mongo-java-driver|legacy”, version: “3.12.1” }, os: { type: “Linux”, name: “Linux”, architecture: “amd64”, version: “5.4.0-1038-aws” }, platform: “Java/Private Build/1.8.0\_282-8u282-b08-0ubuntu1~20.04-b08” } ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 13, 2021, 5:31am UTC](https://community.graylog.org/t/graylog-server-is-not-starting/19659/14 "2021-05-13T05:31:17Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.