Problem when installing graylog

Hello Friends; I hope you are doing well
I have a problem with the installation of my new graylog server
the service won’t start, and i can’t reach the GUI from my pc to the server

this is the message
root@srv-log:/etc/graylog/server# systemctl status graylog-server
● graylog-server.service - Graylog server
Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Sat 2021-07-10 14:16:49 UTC; 5s ago
Docs: htt8p://
Process: 6337 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
Main PID: 6337 (code=exited, status=1/FAILURE)
In below all configuration changes that i made in server.conf

password_secret = A*********
#root_username = admin
root_password_sha2 = 1185fb1546044737330a2a6d5455d24afb31176f5dfa09f8c4750ce7dbe9056ceb28a8
root_timezone = UTC
http_bind_address =
#http_bind_address = [2001:db8::1]:9000
http_publish_uri =
http_external_uri =

Thnak you


Your bind address needs to be specific i.e. the IP of the Graylog server HTTP interface.


Is it possible to see you whole graylog configuration file?
If you do post it could you use the editor in Markdown.
Thanks :slight_smile:

Just an idea for troubleshooting,
Is Elasticsearch servIce enabled and running correct? Also how about MongDb service?

Example of my Graylog server using http

is_master = true
node_id_file = /etc/graylog/server/node-id
password_secret =epOqmLi7r7CdZxl76QOQxr8bRUPYstNdcBuajsaSNfG5bkXXFxyHAAsdgmCfyHhSKlKXjMQG9ojc0bn22EBT17elgGTUJgbD
root_password_sha2 =272c3ac6b26a795a4244d8d2caf1d19a072fbc1c88d497ba1df7fef0a4171ea6
root_email = ""
root_timezone = America/Chicago
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address =
http_enable_cors = true 
elasticsearch_hosts =
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = true
allow_highlighting = false
elasticsearch_analyzer = standard
elasticsearch_index_optimization_timeout = 1h
output_batch_size = 5000
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
message_journal_max_size = 12gb
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost:27017/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
http_connect_timeout = 10s
proxied_requests_thread_pool_size = 32

Hey there @abouhoun , just as a note, the biggest thing that would help here (given that we’re dealing with a log management software) is the logs. Can you upload those as well?

1 Like

@abouhoun aside from what everyone else also mentioned, please change http_external_uri to (or whatever IP address you have assigned to your machine)

Please let us know if that works.

1 Like

Hello dear friends , yes exactly the problem was with http_external_uri ,
it’s fixed
Thank you

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.