centos7安装graylog

1.安装mongodb，添加mongodb的源

vim /etc/yum.repos.d/mongodb-org-3.2.repo

[mongodb-org-3.6]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.6/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-3.6.asc

安装mongodb

yum install mongodb-org

此处可以修改配置文件/etc/mongod.conf ，更改db的目录，默认目录在/var/lib下

启动mongodb

/etc/init.d/mongod start

2.安装Elasticsearch，需要先安装java

yum install java

添加Elasticsearch的源
vim /etc/yum.repos.d/elasticsearch.repo

[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

安装elasticsearch

yum install elasticsearch

修改/etc/elasticsearch/elasticsearch.yml文件在最后添加

cluster.name: graylog                                        #集群名称
nodename: graylog                                            #节点名称
path.data: /data/elasticsearch/data                          #数据存储路径
path.logs: /data/elasticsearch/log                           #日志文件路径
network.host: 192.168.0.102                                  #启动时绑定的IP地址
transport.tcp.port: 9300                                     #启动时绑定的端口
http.port: 9200                                              #http页面的端口
bootstrap.memory_lock: true                                  #锁定内存，不实用swap

创建自定义目录并设置权限

chown elasticsearch.elasticsearch /data/elasticsearch/ -R
chmod 750 /data/elasticsearch/ -R

vim /etc/security/limits.conf添加如下参数

# End of file
* soft nproc 65525
* hard nproc 65535
* soft nofile 65536
* hard nofile 65536

# allow user 'elasticsearch' mlockall
* soft memlock unlimited
* hard memlock unlimited

启动elasticsearch,此处注意，不要用root用户起动服务

/etc/init.d/elasticsearch start

如果有以下报错

[2018-12-17T16:15:18,584][WARN ][o.e.b.JNANatives         ] Unable to lock JVM Memory: error=12, reason=Cannot allocate memory
[2018-12-17T16:15:18,588][WARN ][o.e.b.JNANatives         ] This can result in part of the JVM being swapped out.
[2018-12-17T16:15:18,588][WARN ][o.e.b.JNANatives         ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
[2018-12-17T16:15:18,588][WARN ][o.e.b.JNANatives         ] These can be adjusted by modifying /etc/security/limits.conf, for example: 
        # allow user 'elasticsearch' mlockall
        elasticsearch soft memlock unlimited
        elasticsearch hard memlock unlimited

添加/etc/systemd/system/elasticsearch.service.d/elasticsearch.conf

[Service]
LimitMEMLOCK=infinity

如何验证elasticsearch是否正常启动？
可以访问配置文件里配置的IP加http端口，正常是会出现如下内容

3.安装Graylog

rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-2.4-repository_latest.rpm
yum install graylog-server

安装epel仓库和pwgen软件

rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
yum install -y pwgen          #生成密码使用

pwgen -N 1 -s 96                                                                           #密钥
echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1 #登陆密码

修改配置文件/etc/graylog/server/server.conf

password_secret = XXX                         #前面生成的密钥
root_password_sha2 = XXX                      #前面生成的登陆密码
rest_listen_uri = http://127.0.0.1:9000/api/  #必须制定本机IP不能用127.0.0.1因为会导致外部无法访问
web_listen_uri = http://127.0.0.1:9000/       #必须制定本机IP不能用127.0.0.1因为会导致外部无法访问

启动graylog，默认日志保存在/var/log/graylog-server下

/etc/init.d/graylog-server start