New user needing some help

Graylog Central (peer support)
1

Hi all,

I’m running Ubuntu 18.04 as a headless system, so use webmin and ssh to connect to the box. I’ve installed Graylog following the instructions from this site

I’ve managed to get access to it after a bit of searching and making some changes, but I’m now a bit stuck on how to see the messages reported.

I’ve setup my router to send syslog information to my ubuntu box and graylog is showing that messages are being received (not show if these are from my router or ubuntu), but i’m unable to view them.

When ever I click on search I get the error
Error Message:Unable to perform search query
Details:
Search status code: 500
Search response:cannot GET http://mediaserver:9000/api/search/universal/relative?query=*&range=300&limit=150&sort=timestamp%3Adesc (500)

I’ll be grateful for any advice to help resolve this

thanks

2
  • did you try “System > Indices > {INDEX NAME} > Maintenance > Recalculate image range”
  • is elasticsearch running and reachable?
1 Like
3

2 Likes
4

Hi Jan,

I’ve think I’ve resolved it, found some other instructions on how to install elastic search along with logstash, filebeats and kidana and perform a check to see it was working.

The issue was that had to set elasticsearch use 0.0.0.0 as setting it to 127.0.0.1 only allowed access from the box running it, not from a remote client, setting it to the ip address of the machine which you were also advised to do, meant that graylog could not connect from a remote client.

Once I got elasticsearch and graylog working I removed kidana, logstash and filebeats as they seem to making the processor run @ 100% constantly.

I did also update the rsyslog settings to use port 5140 as when tried using default 514 in graylog it said failed, but when switched to 5140, graylog started receiving the syslog messages

1 Like
5

On Linux, running software on ports <=1024 requires “root” privileges, which a proper Graylog installation does not have. That explains why you had to do this :slight_smile:

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.