{"id":1811,"date":"2023-01-06T23:00:00","date_gmt":"2023-01-06T23:00:00","guid":{"rendered":"https:\/\/www.balajibandi.com\/?p=1811"},"modified":"2023-09-25T14:34:35","modified_gmt":"2023-09-25T13:34:35","slug":"graylog-4-x-installation-and-configuration","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=1811","title":{"rendered":"Graylog 4.X Installation and configuration"},"content":{"rendered":"\n

Part SIEM Build<\/a> <\/p>\n\n\n\n

When I was writing this BLOG – Graylog 5.0 was released but – it required Java 17 (which was not installed on my server and also the one I am testing SIEM\/SOC may be going to break due to the old Java I was running)<\/p>\n\n\n\n

So I have made the decision to go with Graylog 4.X <\/p>\n\n\n\n

You can visit https:\/\/graylog.org – for more information.<\/p>\n\n\n\n

Why I have chosen to go with Graylog 4.X – for the below reasons :<\/p>\n\n\n\n

The main features I like – Search, StreamLine, Pipe Lines, Pipeline Rules, Log normalization, Faster GUI compare to others which I was used (like Syslog-ng, rsyslog), API<\/p>\n\n\n\n

With various inputs it accepts, GELF – Graylog extends log format support and Different extraction pattern support.<\/p>\n\n\n\n

Graylog uses MongoDB to save the configuration – Do not confuse this DB, this is not for Indexes.<\/p>\n\n\n\n

Graylog uses Wazuh Indexer to Store Indexes Data.<\/p>\n\n\n\n

Let’s start installing : <\/p>\n\n\n\n

Pre-requisites for Graylog to install :<\/strong><\/mark><\/p>\n\n\n\n

#apt update && sudo apt upgrade<\/strong><\/p>\n\n\n\n

#apt install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr gnupg wget<\/strong><\/p>\n\n\n\n

MongoDB installation :<\/strong><\/mark><\/p>\n\n\n\n

wget -qO - https:\/\/www.mongodb.org\/static\/pgp\/server-4.4.asc | sudo apt-key add -\necho \"deb http:\/\/repo.mongodb.org\/apt\/debian buster\/mongodb-org\/4.4 main\" | sudo tee <\/strong>\n\/etc\/apt\/sources.list.d\/mongodb-org-4.4.list\n#apt-get update\n#apt-get install -y mongodb-org\n\n#systemctl daemon-reload\n#systemctl enable mongod.service\n#systemctl restart mongod.service\n<\/strong><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Graylog installation :<\/strong><\/mark><\/p>\n\n\n\n
#wget https:\/\/packages.graylog2.org\/repo\/packages\/graylog-4.3-repository_latest.deb<\/h1>\n\n\n\n
#dpkg -i graylog-4.3-repository_latest.deb<\/h1>\n\n\n\n
#apt-get update && sudo apt-get install graylog-server graylog-integrations-plugins<\/h1>\n\n\n\n
Since we are using secure communication between Wazuh Indexer and Graylog<\/p>\n\n\n\n
We going to use Certs as we have generated last time when we installing WAZUH Indexer<\/p>\n\n\n\n
We going to use Java key store for the certs – so we going to add CA root cert which we generated before to java key store as below :<\/p>\n\n\n\n
#mkdir \/etc\/graylog\/server\/certs
#cp -a \/usr\/lib\/jvm\/java-11-openjdk-amd64\/lib\/security\/cacerts \/etc\/graylog\/server\/certs\/cacerts
keytool -importcert -keystore \/etc\/graylog\/server\/certs\/cacerts -storepass changeit -alias root_ca -file #\/etc\/graylog\/server\/certs\/rootCA.crt<\/strong><\/p>\n\n\n\n
Add recently created cacerts keystore that we copied over to our default Graylog Java options.<\/p>\n\n\n\n
#vi \/etc\/default\/graylog-server (the file look as below )<\/p>\n\n\n\n
GRAYLOG_SERVER_JAVA_OPTS=”$GRAYLOG_SERVER_JAVA_OPTS -Dlog4j2.formatMsgNoLookups=true -Djavax.net.ssl.trustStore=\/etc\/graylog\/server\/certs\/cacerts -Djavax.net.ssl.trustStorePassword=XXXXXXXXXXX”<\/strong><\/p>\n\n\n\n
change the java heap – I change to 4G – default is 1G<\/p>\n\n\n\n
GRAYLOG_SERVER_JAVA_OPTS=”-Xms4g -Xmx4g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:-OmitStackTraceInFastThrow”<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We need to add password secret and root password for graylog to run as expected.<\/p>\n\n\n\n
I used below method to generate :<\/p>\n\n\n\n
To create your password_secret<\/code> run the following command:<\/p>\n\n\n\n
# pwgen -N 1 -s 96\nBUJ9fGyuNKKx17iN8cgNYRqE6LBAFXzcVkZXxNhS0OgRQbrNO8LdhBPeRLzhslxW0T5dI6OliFWv1xOFcBFIuB16Cn3STsiS<\/strong><\/pre>\n\n\n\n
To create your root_password_sha2<\/code> run the following command:<\/p>\n\n\n\n
# echo -n \"Enter Password: \" && head -1 <\/dev\/stdin | tr -d '\\n' | sha256sum | cut -d\" \" -f1\nEnter Password: bbbbbbbbb\na08d116c20341f0aadbacaedfae937da31006e7eb7bd4c6e723449776a1c13ba<\/strong>\n\nNow time to edit Graylog config, before we start service :\n\nvi \/etc\/graylog\/server\/server.conf\n\nMy config look like below :\n\n# cat \/etc\/graylog\/server\/server.conf  | egrep -v \"^\\s*(#|$)\"\nis_leader = true\nnode_id_file = \/etc\/graylog\/server\/node-id\npassword_secret = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\nroot_password_sha2 = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n<\/strong>bin_dir = \/usr\/share\/graylog-server\/bin\ndata_dir = \/var\/lib\/graylog-server\nplugin_dir = \/usr\/share\/graylog-server\/plugin\nhttp_bind_address = 0.0.0.0:9000<\/strong>\nelasticsearch_hosts = https:\/\/graylog:XXXXXXXXXXXXXXX@soclab.bb.local:9200<\/strong>\nelasticsearch_discovery_default_scheme = https\nrotation_strategy = count\nelasticsearch_max_docs_per_index = 20000000\nelasticsearch_disable_version_check = true\nelasticsearch_version = 7\n<\/strong>elasticsearch_max_number_of_indices = 20\nretention_strategy = delete\nelasticsearch_shards = 4\nelasticsearch_replicas = 0\nelasticsearch_index_prefix = graylog\nallow_leading_wildcard_searches = false\nallow_highlighting = false\nelasticsearch_analyzer = standard\noutput_batch_size = 500\noutput_flush_interval = 1\noutput_fault_count_threshold = 5\noutput_fault_penalty_seconds = 30\nprocessbuffer_processors = 5\noutputbuffer_processors = 3\nprocessor_wait_strategy = blocking\nring_size = 65536\ninputbuffer_ring_size = 65536\ninputbuffer_processors = 2\ninputbuffer_wait_strategy = blocking\nmessage_journal_enabled = true\nmessage_journal_dir = \/var\/lib\/graylog-server\/journal\nlb_recognition_period_seconds = 3\nmongodb_uri = mongodb:\/\/localhost\/graylog\nmongodb_max_connections = 1000\nmongodb_threads_allowed_to_block_multiplier = 5\nproxied_requests_thread_pool_size = 32\nenabled_tls_protocols= TLSv1.2,TLSv1.3\nskip_preflight_checks = true\n\nI have just Modified the BOLD<\/strong> in the config. and Save the config.\n\nTime to restart Graylog to take effect of new config :\n\n#systemctl stop graylog-server.service\n#systemctl restart graylog-server.service\n#systemctl status graylog-server.service<\/strong><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now time to access Graylog GUI<\/p>\n\n\n\n
https:\/\/soclab.bb.local:9000<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Holaaaaaaaaaaaaaaaaaaa …<\/p>\n\n\n\n
Now looks like everything working as expected.<\/p>\n\n\n\n
See you next steps –<\/p>\n\n\n\n
Graylog – Indices, streamline,inputs,pipelines<\/p>\n\n\n\n
Happy Labbbinggggggggggggggggggggggggg!<\/p>\n","protected":false},"excerpt":{"rendered":"
Part SIEM Build When I was writing this BLOG – Graylog 5.0 was released but – it required Java 17 (which was not installed on my server and also the one I am testing SIEM\/SOC may be going to break due to the old Java I was running) So I have made the decision to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,6],"tags":[],"class_list":["post-1811","post","type-post","status-publish","format-standard","hentry","category-linux","category-security"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1811","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1811"}],"version-history":[{"count":3,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1811\/revisions"}],"predecessor-version":[{"id":1930,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1811\/revisions\/1930"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}