Host collected logs on another drive?

Graylog Central (peer support)
1

Dear Graylog Community,

Has anyone successfully managed to put all the data collected by Graylog on a second hard-drive or partition, in order to have the place where the logs are stored and the OS space separated ?

If yes, can you explain how you did ?

Here is my configuration :

  • Debian 11
  • Graylog 4.3.7
  • Elasticsearch (transitionning to OpenSearch in the next few weeks)
  • 60G drive for OS, 2To drive for data

Many thanks in advance,

G. MORIN

2

Hi @gmorin,

The data collection is located in the Elastic DB (default /var/lib/elasticsearch/) and The journal is located at /var/lib/graylog/journal (default). GL-Configurations is here (default /var/lib/mongodb).
You can set that as a separate mount points. Is this what you mean?

3

Hum yes maybe, what I don’t want is having my 60G drive filled with logs ^^
So playing with fstab may be the solution to get the /var/lib/elasticsearch/ on the 2To drive ?

4

Yes it is. You can just set /var/lib of /dev/[2TB-Dev] as your own mount point in fstab.

2 Likes
5

Hi @H077E,

That’s great ! Many thanks ! :yum:

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.