Problem when installing graylog

Hello Friends; I hope you are doing well
I have a problem with the installation of my new graylog server
the service won’t start, and i can’t reach the GUI from my pc to the server

this is the message
“”"""""""""""""""""""""""""""""""""
root@srv-log:/etc/graylog/server# systemctl status graylog-server
● graylog-server.service - Graylog server
Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Sat 2021-07-10 14:16:49 UTC; 5s ago
Docs: htt8p://docs.graylog.org/
Process: 6337 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
Main PID: 6337 (code=exited, status=1/FAILURE)
“”""""""""""""""""""""""""""""""""
In below all configuration changes that i made in server.conf
“”"""""""""""""""""""""""""""""""""

password_secret = A*********
#root_username = admin
root_password_sha2 = 1185fb1546044737330a2a6d5455d24afb31176f5dfa09f8c4750ce7dbe9056ceb28a8
root_timezone = UTC
#Default: 127.0.0.1:9000
http_bind_address = 0.0.0.0:9000
#http_bind_address = [2001:db8::1]:9000
http_publish_uri = http://0.0.0.0:9000/
http_external_uri = 0.0.0.0:9000

Thnak you

Regards

Your bind address needs to be specific i.e. the IP of the Graylog server HTTP interface.

https://docs.graylog.org/en/latest/pages/configuration/web_interface.html#configuration-options

Hello,

Is it possible to see you whole graylog configuration file?
If you do post it could you use the editor in Markdown.
format-markdown
Thanks :slight_smile:


Just an idea for troubleshooting,
Is Elasticsearch servIce enabled and running correct? Also how about MongDb service?

Example of my Graylog server using http

Graylog_Config
is_master = true
node_id_file = /etc/graylog/server/node-id
password_secret =epOqmLi7r7CdZxl76QOQxr8bRUPYstNdcBuajsaSNfG5bkXXFxyHAAsdgmCfyHhSKlKXjMQG9ojc0bn22EBT17elgGTUJgbD
root_password_sha2 =272c3ac6b26a795a4244d8d2caf1d19a072fbc1c88d497ba1df7fef0a4171ea6
root_email = "greg.smith@domain.com"
root_timezone = America/Chicago
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = 10.10.10.10:9000
http_enable_cors = true 
elasticsearch_hosts = http://10.10.10.10:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = true
allow_highlighting = false
elasticsearch_analyzer = standard
elasticsearch_index_optimization_timeout = 1h
output_batch_size = 5000
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
message_journal_max_size = 12gb
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost:27017/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
http_connect_timeout = 10s
proxied_requests_thread_pool_size = 32

Hey there @abouhoun , just as a note, the biggest thing that would help here (given that we’re dealing with a log management software) is the logs. Can you upload those as well?

1 Like

@abouhoun aside from what everyone else also mentioned, please change http_external_uri to http://192.168.5.101 (or whatever IP address you have assigned to your machine)

Please let us know if that works.

1 Like

Hello dear friends , yes exactly the problem was with http_external_uri ,
it’s fixed
Thank you