I am working on a new installation of Graylog open. The service is running, but I can not access the web interface outside of the server. I am able to see the connections on the server, but no response from the service. The following is from the server.log. Any help is much appreciated. Thanks.
From the server.log:
2022-05-25T15:35:08.386-04:00 INFO [ServerBootstrap] Graylog server 4.2.9+f0d8298 starting up
2022-05-25T15:35:08.387-04:00 INFO [ServerBootstrap] JRE: Red Hat, Inc. 11.0.15 on Linux 4.18.0-348.23.1.el8_5.x86_64
2022-05-25T15:35:08.387-04:00 INFO [ServerBootstrap] Deployment: rpm
2022-05-25T15:35:08.387-04:00 INFO [ServerBootstrap] OS: Red Hat Enterprise Linux 8.5 (Ootpa) (rhel)
2022-05-25T15:35:08.387-04:00 INFO [ServerBootstrap] Arch: amd64
2022-05-25T15:35:08.424-04:00 INFO [PeriodicalsService] Starting 37 periodicals …
…
2022-05-25T15:35:13.626-04:00 INFO [ServerBootstrap] Graylog server up and running.
2022-05-25T15:35:13.626-04:00 ERROR [AuditLogger] Unable to write audit log entry because there is no valid license.
The HTTP configuration:
###############
# HTTP settings
###############
#### HTTP bind address
#
# The network interface used by the Graylog HTTP interface.
#
# This network interface must be accessible by all Graylog nodes in the cluster and by all clients
# using the Graylog web interface.
#
# If the port is omitted, Graylog will use port 9000 by default.
#
# Default: 127.0.0.1:9000
# Modified from 9000 to 80 by DW on May 19, 2022
http_bind_address = 172.18.1.4:9000
#### HTTP publish URI
#
# The HTTP URI of this Graylog node which is used to communicate with the other Graylog nodes in the cluster and by all
# clients using the Graylog web interface.
#
# The URI will be published in the cluster discovery APIs, so that other Graylog nodes will be able to find and connect to this Graylog node.
#
# This configuration setting has to be used if this Graylog node is available on another network interface than $http_bind_address,
# for example if the machine has multiple network interfaces or is behind a NAT gateway.
#
# If $http_bind_address contains a wildcard IPv4 address (0.0.0.0), the first non-loopback IPv4 address of this machine will be used.
# This configuration setting *must not* contain a wildcard address!
#
# Default: http://$http_bind_address/
# Modified by DW on May 19, 2022
http_publish_uri = http://$http_bind_address/
#### External Graylog URI
#
# The public URI of Graylog which will be used by the Graylog web interface to communicate with the Graylog REST API.
#
# The external Graylog URI usually has to be specified, if Graylog is running behind a reverse proxy or load-balancer
# and it will be used to generate URLs addressing entities in the Graylog REST API (see $http_bind_address).
#
# When using Graylog Collector, this URI will be used to receive heartbeat messages and must be accessible for all collectors.
#
# This setting can be overriden on a per-request basis with the "X-Graylog-Server-URL" HTTP request header.
#
# Default: $http_publish_uri
#http_external_uri = $http_publish_uri
http_external_uri = http://$http_bind_address/
#### Enable CORS headers for HTTP interface
#
# This allows browsers to make Cross-Origin requests from any origin.
# This is disabled for security reasons and typically only needed if running graylog
# with a separate server for frontend development.
#
# Default: false
http_enable_cors = true
#### Enable GZIP support for HTTP interface
#
# This compresses API responses and therefore helps to reduce
# overall round trip times. This is enabled by default. Uncomment the next line to disable it.
#http_enable_gzip = false
# The maximum size of the HTTP request headers in bytes.
http_max_header_size = 8192
# The size of the thread pool used exclusively for serving the HTTP interface.
http_thread_pool_size = 16
Hello && Welcome
To help you further we would need more information ( hence, the Text Template should have explain this before posting).
The INFO logs that were post does not show what’s wrong, it also shows Graylog server starting up at that point.
Only reason you see this log because the enterprise plugin is install, This is common.
Reason I stated this, the issue could be multiple things, which I don’t wont to list every one here , what we need to do is narrow it down to a couple and troubleshoot.
Here are a couple ideas
- Check configuration
- Check permissions
- Check network on Graylog node.
- Check security devices
- Check browser/s
- Check resources ( i.e. cpu, ram, disk, etc…)
1 Like
Thanks for the help. I did not realize the server team applied local firewall. Now the problem has been solved.
1 Like
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.