Graylog syslog server on Raspberry Pi 4 (8gb)
This is how I installed graylog on my Pi.
1.- Raspberry Pi 4 - 8 GB Ram with firmware patch to boot from USB.
2.- Geekworm Raspberry Pi 4 mSATA SSD Adapter X857.
3.- MSata drive (using a 250 gb drive).
4.- Raspbian/Debian, Ubuntu aarch64.
5.- Network connection (Ethernet, WiFi and BT disabled).
6.- Rpi4 heatsinks (optional/recommended).
Install OS (Raspbian Aarch64) on the MSata drive, boot the raspberry pi and then do
# sudo apt update && apt full-upgrade -y
# sudo apt install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr gnupg wget zip curl
# curl -s https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add -
# echo "deb [ arch=arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.2 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.2.list
# sudo apt update && sudo apt install mongodb-org -y
# sudo systemctl enable mongod
# sudo systemctl start mongod
# sudo systemctl status mongod
# wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
# echo "deb [ arch=arm64 ] https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
# sudo apt update && sudo apt install elasticsearch-oss -y
# sudo tee -a /etc/elasticsearch/elasticsearch.yml > /dev/null <<EOT
cluster.name: graylog
network.host: 127.0.0.1
http.port: 9200
action.auto_create_index: false
EOT
# sudo systemctl daemon-reload
# sudo systemctl enable elasticsearch.service
# sudo systemctl restart elasticsearch.service
Download the latest graylog-x.x.x.tgz from https://www.graylog.org/downloads-2 and scp it to your PI or
# wget https://downloads.graylog.org/releases/graylog/graylog-x.x.x.tgz
# sudo tar -xf graylog-x.x.x.tgz
# sudo mv /opt/graylog-x.x.x /opt/graylog
# sudo rm graylog-x.x.x.tgz
# vi /etc/graylog/server/server.conf and configure to your needs
After the server started go to http://server-ip:9000 and use the user admin with the password previously configured, create an input and that should be all.
To configure password and settings on server.conf please refer to graylog documentation.