mirror of
https://github.com/krislamo/graylog_demo
synced 2024-11-09 21:50:35 +00:00
55 lines
3.7 KiB
Markdown
55 lines
3.7 KiB
Markdown
# Graylog Demo
|
|
|
|
|
|
This is a demonstration of Graylog, a centralized log management system featuring a shell provisioned CentOS 7 Vagrant box. To illustrate various log collection methods `httpd`, `rsyslog` and `docker` are installed and a simple WordPress instance is deployed via Docker Compose. Log collection incorporates td-agent (a version of Fluentd) to ship logs into a Graylog instance from containers, the syslog, and arbitrary filesystem logs.
|
|
|
|
This demonstration assumes you are familiar with using Vagrant + VirtualBox to automate the installation of virtual machines, although you can reference the Vagrantfile's shell provisioning sections to manually set up a system if you so desire. Please install these prerequisites before attempting the quick start below.
|
|
|
|
#### Notes about setup
|
|
- This demonstration uses Traefik for some routing and the [xip.io](http://xip.io/) wildcard DNS service. If DNS fails to resolve for whatever reason you may want to set the domains to the IP inside your operating system's hosts file, e.g.
|
|
|
|
```
|
|
172.28.128.30 traefik.172.28.128.30.xip.io
|
|
172.28.128.30 graylog.172.28.128.30.xip.io
|
|
```
|
|
|
|
- Vagrant will provision two virtual machines with two consecutive private Class B addresses (starting from `172.28.128.30`). If you would like to change this base IP address to something different you will need to look through the project and find various references. Unfortunately, this is not a simple variable you can set for the entire project.
|
|
|
|
- Vagrant is set to allocate 4 cores and 4 GB of RAM per machine (this is 8 cores / 8 GB of memory total) you may need to adjust this for your machine if necessary.
|
|
|
|
- After deploying, Graylog takes the longest to become available and it may take 30 seconds to a few minutes to bring it up depending on your machine.
|
|
|
|
- The [Traefik dashboard](http://traefik.172.28.128.30.xip.io:8080/dashboard/#/) is available using `admin` for both the username and password.
|
|
|
|
#### _This project is a demonstration only and should not be used in a production environment._
|
|
|
|
|
|
## Quick Start
|
|
_This section assumes you will be using the default `172.28.128.30` and `172.28.128.31` IP addresses_
|
|
1. Clone the repository and navigate inside its directory
|
|
2. Create and provision the VM using `vagrant up`
|
|
3. Navigate to [http://graylog.172.28.128.30.xip.io:8080/](http://graylog.172.28.128.30.xip.io:8080/)
|
|
4. Login using `admin` for both the username and password.
|
|
5. Click on `Search` on the top menu on the left
|
|
6. You may want to "Search in all messages" on the left under the top menu
|
|
7. Press the start button on the top right to start updating the feed every second
|
|
|
|
#### Docker Test
|
|
- Generate Docker logs by simply navigating to the WordPress install page: [http://172.28.128.31:8080](http://172.28.128.31:8080/wp-admin/install.php)
|
|
|
|
#### File Test
|
|
- Collect logs from Apache's `access_log` file by going to [http://172.28.128.31/](http://172.28.128.31/)
|
|
|
|
#### Syslog Test
|
|
1. Go back to the terminal inside the project's directory and type `vagrant ssh systems` or `vagrant ssh graylog`
|
|
2. You can test Syslog collection with `logger` e.g. `logger -t test Hello world` (or just wait for some to appear)
|
|
|
|
### Copyrights and Licenses
|
|
Copyright (C) 2020 Kris Lamoureux
|
|
|
|
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
|
|
|
|
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
|