This site can’t be reached. New Installation Debian 9, graylog version 3.1, google cloud

[sujith]

sudo systemctl status graylog-server.service
● graylog-server.service - Graylog server
Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; enabled; vendor pre
Active: active (running) since Mon 2019-10-21 03:56:33 UTC; 38min ago
Docs: http://docs.graylog.org/
Main PID: 29440 (graylog-server)
CGroup: /system.slice/graylog-server.service
├─29440 /bin/sh /usr/share/graylog-server/bin/graylog-server
└─29441 /usr/bin/java -Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB

password_secret generated using pwgen -N 1 -s 96
root_password_sha2 generated using echo -n password | sha256sum
http_bind_address= 127.0.0.1:9000
http_publish_uri = http://my_public_ip:9000

added port 9000 open

curl -i -H ‘Accept: application/json’ http:ip:9000 failed to connect

netstat -tln
Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp6 0 0 127.0.0.1:9000 :::* LISTEN
tcp6 0 0 127.0.0.1:9200 :::* LISTEN
tcp6 0 0 ::1:9200 :::* LISTEN
tcp6 0 0 :::80 :::* LISTEN
tcp6 0 0 127.0.0.1:9300 :::* LISTEN
tcp6 0 0 ::1:9300 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN

Still http://my_ip:9000/

This site can’t be reached.

refused to connect.

[jan (Jan Doberstein)]

http_bind_address = 127.0.0.1:9000
http_publish_uri = http://my_public_ip:9000

When Graylog binds to localhost but given the public URL to reach itself … How should the service reach itself if you configure that it should listen on localhost but give a different location for the reachable device.

Use the external IP to bind to or if that is not possible listen on any ip and hope that some firewall will protect you and route the external ip to the right device.

I do not know how you can to networking in Google Cloud but you need to understand that and configure Graylog accordingly.

[sujith]

Can you suggest me what changes have to made in /etc/graylog/server/server.conf
http_bind_address=my_ip:9000 ?
for accessing graylog console on my http://my_ip:9000

[shoothub]

1. Try to use any ip address as Jan suggested:
   http_bind_address = 0.0.0.0:9000

2. Or your external IP address if it is directly available in debian as interface:
   http_bind_address = your_ip:9000

3. Because graylog listen on HTTP (unencrypted) connection by default (port 9000), it would be better to use encryption using HTTPS, check this:
   https://docs.graylog.org/en/3.1/pages/configuration/https.html#ssl-setup
   https://docs.graylog.org/en/3.1/pages/configuration/web_interface.html#configuring-webif-nginx

4. If you don’t want to open graylog interface to all world, it would be better to allow connection using firewall only from IP you are connecting.

[sujith]

http_bind_address = my_ip:9000
but no change.

[shoothub]

Try to use, if it works:

http_bind_address = 0.0.0.0:9000

[sujith]

Bro thanks for the supports
I created a virtual host and problem solved

http_bind_address = 127.0.0.1:9000

---

<VirtualHost *:80>
ServerName graylog.mydomain.com        
 ServerAlias  www.graylog.mydomain.com  
ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all

<Location />
 
   Options Indexes FollowSymLinks
   AllowOverride All
   Require all granted
   RequestHeader set X-Graylog-Server-URL "http://graylog.mydomain.com/"
   ProxyPass http://127.0.0.1:9000/
   ProxyPassReverse  http://127.0.0.1:9000/
</Location>
-----------------------------------------------------------------------------------------------------------

sudo a2enmod ssl
sudo a2enmod proxy
sudo a2enmod proxy_balancer
sudo a2enmod proxy_http
sudo /etc/init.d/apache2 restart