Graylog starts but browser shows apache default page

selroc · May 3, 2020, 4:26pm

systemctl status graylog-server.service shows a warning:

graylog-server.service - Graylog server
Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2020-05-03 17:47:38 CEST; 4min 18s ago
Docs: http://docs.graylog.org/
Main PID: 8790 (graylog-server)
Tasks: 105 (limit: 4662)
Memory: 774.3M
CGroup: /system.slice/graylog-server.service
├─8790 /bin/sh /usr/share/graylog-server/bin/graylog-server
└─8809 /usr/bin/java -Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:-OmitStackTraceInFastThrow -jar -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Djava.library.path=/usr/share/graylog-server/lib/sigar -Dgraylog2.installation_source=deb /usr/share/graylog-server/graylog.jar server -f /etc/graylog/server/server.conf -np

May 03 17:47:38 master03 systemd[1]: Started Graylog server.
May 03 17:47:38 master03 graylog-server[8790]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
May 03 17:47:38 master03 graylog-server[8790]: WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.
May 03 17:47:41 master03 graylog-server[8790]: WARNING: An illegal reflective access operation has occurred
May 03 17:47:41 master03 graylog-server[8790]: WARNING: Illegal reflective access by com.google.inject.assistedinject.FactoryProvider2$MethodHandleWrapper (file:/usr/share/graylog-server/graylog.jar) to constructor java.lang.invoke.MethodHandles$Lookup(java.lang.Class,int)
May 03 17:47:41 master03 graylog-server[8790]: WARNING: Please consider reporting this to the maintainers of com.google.inject.assistedinject.FactoryProvider2$MethodHandleWrapper
May 03 17:47:41 master03 graylog-server[8790]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
May 03 17:47:41 master03 graylog-server[8790]: WARNING: All illegal access operations will be denied in a future release

shoothub · May 5, 2020, 8:57am

Check your java version, best is to run java 8 (Oracle or OpenJDK). Compatibily with java 11 is present in latest version, but can be unstable, see:
https://docs.graylog.org/en/3.2/pages/installation.html#system-requirements

Check if graylog web interface listen on port 9000. Apache is used as reverse proxy, so graylog interface is reachable on port HTTP/HTTPS, check your apache reverse proxy configration, if you see default apache welcome page…

selroc · May 5, 2020, 2:40pm

I have restarted installation from scratch using java 8, but elasticsearch is complaining about x-pack:

systemctl status elasticsearch.service -l
● elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Tue 2020-05-05 16:09:45 CEST; 52s ago
Docs: http://www.elastic.co
Process: 7005 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE)
Main PID: 7005 (code=exited, status=1/FAILURE)

May 05 16:09:45 master03 elasticsearch[7005]: at org.elasticsearch.cli.Command.main(Command.java:90)
May 05 16:09:45 master03 elasticsearch[7005]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:116)
May 05 16:09:45 master03 elasticsearch[7005]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93)
May 05 16:09:45 master03 elasticsearch[7005]: 2020-05-05 16:09:45,673 main ERROR Null object returned for RollingFile in Appenders.
May 05 16:09:45 master03 elasticsearch[7005]: 2020-05-05 16:09:45,673 main ERROR Unable to locate appender “rolling” for logger config “root”
May 05 16:09:45 master03 elasticsearch[7005]: 2020-05-05 16:09:45,674 main ERROR Unable to locate appender “index_indexing_slowlog_rolling” for logger config "index.indexing.sl
May 05 16:09:45 master03 elasticsearch[7005]: 2020-05-05 16:09:45,674 main ERROR Unable to locate appender “index_search_slowlog_rolling” for logger config "index.search.slowlo
May 05 16:09:45 master03 elasticsearch[7005]: 2020-05-05 16:09:45,674 main ERROR Unable to locate appender “deprecation_rolling” for logger config "org.elasticsearch.deprecatio
May 05 16:09:45 master03 systemd[1]: elasticsearch.service: Main process exited, code=exited, status=1/FAILURE
May 05 16:09:45 master03 systemd[1]: elasticsearch.service: Failed with result ‘exit-code’.

However I cannot find an x-pack version that works .

shoothub · May 5, 2020, 2:54pm

Graylog docs recommend to use elasticsearch-oss
package without x-pack:
https://docs.graylog.org/en/3.2/pages/installation/os/ubuntu.html#elasticsearch
https://docs.graylog.org/en/3.2/pages/installation/os/debian.html#elasticsearch
https://docs.graylog.org/en/3.2/pages/installation/os/centos.html#elasticsearch

Did you follow official docs?

selroc · May 5, 2020, 3:00pm

I am following this guide step by step:

https://docs.graylog.org/en/3.2/pages/installation/os/debian.html

with java 8

shoothub · May 5, 2020, 4:26pm

If you previously install elastic, try to purge package before new installation:
apt purge elasticsearch-oss

and after that install again:
apt install elasticsearch-oss

selroc · May 5, 2020, 6:22pm

apparently it worked, thank you.

systemctl status elasticsearch.service
● elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2020-05-05 20:21:00 CEST; 5s ago
Docs: http://www.elastic.co
Main PID: 7756 (java)
Tasks: 22 (limit: 4662)
Memory: 1.2G
CGroup: /system.slice/elasticsearch.service
└─7756 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Des.networkaddress.cache.ttl=60 -Des

May 05 20:21:00 master03 systemd[1]: Started Elasticsearch.

selroc · May 5, 2020, 6:47pm

Thanks for support. Graylog is now running.

selroc · May 5, 2020, 6:54pm

Now, how do I get syslog-ng to send tcp input to graylog?

selroc · May 6, 2020, 8:55am

I have configure a global input, but it fails to start:

Global inputs 1 configured

master03 Syslog TCP 1 FAILED

allow_override_date:
 true
bind_address:
 0.0.0.0
expand_structured_data:
 false
force_rdns:
 false
max_message_size:
 2097152
number_worker_threads:
 4
override_source:
 <empty>
port:
 514
recv_buffer_size:
 1048576
store_full_message:
 true
tcp_keepalive:
 false
tls_cert_file:
 <empty>
tls_client_auth:
 disabled
tls_client_auth_cert_file:
 <empty>
tls_enable:
 false
tls_key_file:
 <empty>
tls_key_password:
********
use_null_delimiter:
 false

shoothub · May 7, 2020, 12:37pm

You can’t run Input on port 514b by default, because graylog run as a normal user, which couldn’t listenon lower port than 1024. So best option is to change Input port to e.g. 1514 and setup syslog-ng to forward logs to this port (instead of default 1514).

Another option if you can’t change forwarding port (some network devices) is to setup iptables to forward port 514.
https://docs.graylog.org/en/3.2/pages/faq.html#how-can-i-start-an-input-on-a-port-below-1024

selroc · May 7, 2020, 1:24pm

Thank you. I thinkyou can close this issue.

system · May 21, 2020, 1:24pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Graylog can't active Graylog Central (peer support)	6	3422	April 2, 2018
No access graylog webinterface Graylog Central (peer support)	1	330	July 2, 2019
Update Graylog 5.0.5 to 5.0.6 Graylog Central (peer support)	2	363	April 26, 2023
Graylog start erorr Graylog Central (peer support)	3	463	September 20, 2022
Graylog service active but application not running Graylog Central (peer support)	4	1118	December 7, 2022

Graylog starts but browser shows apache default page

Related topics