Sidecar installation and startup on RHEL 9

Graylog Central (peer support)
1

Hi all,

I’m trying to deploy a Linux sidecar and filebeat collector on a host running RHEL 9, to send logs to a new Graylog 7 server. I’m following the documentation found here, but running into an issue with enabling and starting the sidecar service. These are the general steps I have taken so far:

  1. Downloaded and installed the repo:
    wget ``https://packages.graylog2.org/repo/packages/graylog-sidecar-1.5-repository_latest.rpm
    sudo rpm -i graylog-sidecar-1.5-repository_latest.rpm
  2. Installed graylog-sidecar:
    sudo yum install graylog-sidecar
  3. Edited /etc/graylog/sidecar/sidecar.yml and set the appropriate config values

The next step is to enable and start the graylog-sidecar service, but systemctl threw an error:

$ sudo systemctl enable graylog-sidecar
Failed to enable unit: Unit file graylog-sidecar.service does not exist.

And indeed, the graylog-sidecar RPM does not include any systemd service files:

$ rpm -ql graylog-sidecar
/etc/graylog
/etc/graylog/sidecar
/etc/graylog/sidecar/sidecar.yml
/usr/bin/graylog-sidecar
/usr/lib/.build-id
/usr/lib/.build-id/74
/usr/lib/.build-id/74/79b116ac3037ce65f85f9a24132b1b4491c19d
/usr/lib/.build-id/f3
/usr/lib/.build-id/f3/9f274352929440b2c54bf9ec01f13c2c10bbb7
/usr/lib/graylog-sidecar
/usr/lib/graylog-sidecar/auditbeat
/usr/lib/graylog-sidecar/filebeat
/var/lib/graylog-sidecar
/var/lib/graylog-sidecar/generated
/var/log/graylog-sidecar
/var/run/graylog-sidecar

Has there been a change to the sidecar RPM deployment procedure? Or did I install the wrong package, perhaps?

Any help is greatly appreciated!

2

Ok, I solved the issue. The documentation is missing a critical step. You first need to run:

sudo graylog-sidecar -service install

The systemd unit file gets created, and then systemctl works as expected.

Found the answer thanks to pointers in a few previous topics:
https://community.graylog.org/t/installing-graylog-sidecar-on-linux-2-x-rhel-6/
https://community.graylog.org/t/unit-graylog-sidecar-service-not-found-ubuntu-linux-20-04

3

Ya the docs used to include

vi /etc/graylog/sidecar/sidecar.yml

sudo graylog-sidecar -service install

sudo systemctl enable graylog-sidecar
sudo systemctl start graylog-sidecar

Here is the older page, I’ll check with the docs team on why it’s gone missing in the current version.

4

Thanks, Joel!

The link to the GitHub page is also gone, and that would have been very handy to have because graylog-sidecar<version>.rpm does not intuitively translate to graylog-sidecar-1.5-repository_latest.rpm when you’re trying to download that first RPM. I had to look through the repo site in a browser to find the actual URL of that file, but it’s readily accessible on the GitHub page.