Unable to view web interface

Graylog Central (peer support)
1

Hi , i have recently tried installing graylog 3.0.2 on a centos 7.6. The installation was successful. However , i am unable to view the web interface when accessed behind a nginx. The web interface is directly viewable using the server’s ip in the browser without any issue. I am not seeing any errors in the server.log (graylog log). Is there anything else to be done? I am not sure , ver 3.x seem to be a lil different, seeking some advice here thanks

Blockquote2019-05-06T16:33:41.307+08:00 INFO [JerseyService] Enabling CORS for HTTP endpoint
2019-05-06T16:34:00.714+08:00 INFO [NetworkListener] Started listener bound to [10.0.0.114:9000]
2019-05-06T16:34:00.715+08:00 INFO [HttpServer] [HttpServer] Started.
2019-05-06T16:34:00.716+08:00 INFO [JerseyService] Started REST API at <10.0.0.114:9000>
2019-05-06T16:34:00.717+08:00 INFO [ServiceManagerListener] Services are healthy
2019-05-06T16:34:00.717+08:00 INFO [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2019-05-06T16:34:00.717+08:00 INFO [ServerBootstrap] Services started, startup times in ms: {GracefulShutdownService [RUNNING]=2, BufferSynchronizerService [RUNNING]=3, InputSetupService [RUNNING]=5, OutputSetupService [RUNNING]=9, KafkaJournal [RUNNING]=10, JournalReader [RUNNING]=14, EtagService [RUNNING]=15, ConfigurationEtagService [RUNNING]=16, StreamCacheService [RUNNING]=36, LookupTableService [RUNNING]=39, PeriodicalsService [RUNNING]=69, JerseyService [RUNNING]=19720}
2019-05-06T16:34:00.724+08:00 INFO [ServerBootstrap] Graylog server up and running.

2

check netstat -ntlp | grep 9000
if you have a listening port, you can check the ip traffic with tcpdump, to be sure GL gets your package from your browser

3

2 posts were split to a new topic: Graylog 3 in subdirectory

5

you left no information about your setup. So I can only point to the documentation

http://docs.graylog.org/en/3.0/pages/configuration/web_interface.html#nginx

Did you configured your Nginx correctly?

6

Hi Jan,

Yes the nginx seems correct . this works well with the earlier version of graylog 2.x
below is my current nginx config for the 3.0 version which i mention here

and below is the graylog config

[root@115graylog ~]# grep -v “#” /etc/graylog/server/server.conf

is_master = true

node_id_file = /etc/graylog/server/node-id

password_secret = xxxxx

root_password_sha2 = xxxxxx

root_email = “sysad@domain.com”

root_timezone = Etc/GMT-8

bin_dir = /usr/share/graylog-server/bin

data_dir = /var/lib/graylog-server

plugin_dir = /usr/share/graylog-server/plugin

http_bind_address = 10.0.0.114:9000

http_publish_uri = http://10.0.0.114:9000/

rotation_strategy = count

elasticsearch_max_docs_per_index = 20000000

elasticsearch_max_number_of_indices = 20

retention_strategy = delete
elasticsearch_shards = 1
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false

allow_highlighting = false

elasticsearch_analyzer = standard

output_batch_size = 500

output_flush_interval = 1

output_fault_count_threshold = 5
output_fault_penalty_seconds = 30

processbuffer_processors = 5
outputbuffer_processors = 3

processor_wait_strategy = blocking

ring_size = 65536

inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking

message_journal_enabled = true

message_journal_dir = /var/lib/graylog-server/journal

lb_recognition_period_seconds = 3

mongodb_uri = mongodb://localhost/graylog

mongodb_max_connections = 1000

mongodb_threads_allowed_to_block_multiplier = 5

proxied_requests_thread_pool_size = 32

verified port 9000 is listening on the graylog host

[root@115graylog ~]# netstat -ntlp|grep 9000
tcp6 0 0 10.0.0.114:9000 :::* LISTEN 5123/java
[root@115graylog ~]#

7

I have verified that traffic do comes in my graylog server at port 9000 when i launch the URL in a browser (graylog.domain.com) but no output in screen

[root@115graylog ~]# tcpdump port 9000
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:30:02.948040 IP 10.0.0.140.6172 > 115graylog.cslistener: Flags [S], seq 3309343323, win 29200, options [mss 1460,sackOK,TS val 2429331687 ecr 0,nop,wscale 9], length 0
14:30:02.948083 IP 115graylog.cslistener > 10.0.0.140.6172: Flags [S.], seq 397150523, ack 3309343324, win 28960, options [mss 1460,sackOK,TS val 81044134 ecr 2429331687,nop,wscale 7], length 0
14:30:02.948258 IP 10.0.0.140.6172 > 115graylog.cslistener: Flags [.], ack 1, win 58, options [nop,nop,TS val 2429331687 ecr 81044134], length 0
14:30:02.948341 IP 10.0.0.140.6172 > 115graylog.cslistener: Flags [P.], seq 1:1305, ack 1, win 58, options [nop,nop,TS val 2429331687 ecr 81044134], length 1304
14:30:02.948347 IP 115graylog.cslistener > 10.0.0.140.6172: Flags [.], ack 1305, win 247, options [nop,nop,TS val 81044134 ecr 2429331687], length 0
14:30:02.958179 IP 115graylog.cslistener > 10.0.0.140.6172: Flags [P.], seq 1:1583, ack 1305, win 247, options [nop,nop,TS val 81044144 ecr 2429331687], length 1582
14:30:02.958383 IP 10.0.0.140.6172 > 115graylog.cslistener: Flags [.], ack 1583, win 64, options [nop,nop,TS val 2429331697 ecr 81044144], length 0
14:30:02.958441 IP 10.0.0.140.6172 > 115graylog.cslistener: Flags [F.], seq 1305, ack 1583, win 64, options [nop,nop,TS val 2429331697 ecr 81044144], length 0
14:30:02.958628 IP 115graylog.cslistener > 10.0.0.140.6172: Flags [F.], seq 1583, ack 1306, win 247, options [nop,nop,TS val 81044144 ecr 2429331697], length 0
14:30:02.958752 IP 10.0.0.140.6172 > 115graylog.cslistener: Flags [.], ack 1584, win 64, options [nop,nop,TS val 2429331698 ecr 81044144], length 0
14:30:03.072796 IP 10.0.0.140.6174 > 115graylog.cslistener: Flags [S], seq 1077001035, win 29200, options [mss 1460,sackOK,TS val 2429331812 ecr 0,nop,wscale 9], length 0
14:30:03.072868 IP 115graylog.cslistener > 10.0.0.140.6174: Flags [S.], seq 2852087950, ack 1077001036, win 28960, options [mss 1460,sackOK,TS val 81044259 ecr 2429331812,nop,wscale 7], length 0
14:30:03.072895 IP 10.0.0.140.6176 > 115graylog.cslistener: Flags [S], seq 1624516433, win 29200, options [mss 1460,sackOK,TS val 2429331812 ecr 0,nop,wscale 9], length 0
14:30:03.072901 IP 115graylog.cslistener > 10.0.0.140.6176: Flags [S.], seq 4291491596, ack 1624516434, win 28960, options [mss 1

8

i have fixed the issue and turns out to be the this line in my nginx ;

earlier i had it “proxy_set_header X-Graylog-Server-URL https://$server_name/api/;”

and i have fixed it by removing the /api/ and leaving it with just “proxy_set_header X-Graylog-Server-URL https://$server_name/;”

thank so much!
btw pls forgive me for the poor formating on the logs/config posted here. i am not too sure abt the proper formatting options here. i will read on that and write better the next time. thanks again !! i will regard this thread as ‘CLOSED’. Have a nice day guys :slight_smile:

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.