Graylog Demo

This is a demonstration of Graylog, a centralized log management system featuring a shell provisioned CentOS 7 Vagrant box. To illustrate various log collection methods httpd, rsyslog and docker are installed and a simple WordPress instance is deployed via Docker Compose. Log collection incorporates Fluentd to ship logs into a Graylog instance from containers, the syslog, and arbitrary filesystem logs.

This demonstration assumes you are familiar with using Vagrant + VirtualBox to automate the installation of virtual machines, although you can reference the Vagrantfile's shell provisioning sections to manually set up a system if you so desire. Please install these prerequisites before attempting the quick start below.

Notes about setup

This demonstration uses Traefik for routing and the xip.io wildcard DNS service. If DNS fails to resolve you may want to set the domains to the IP inside your operating system's hosts file.
Vagrant will provision a virtual machine with a static private Class B address (specifically 172.28.128.30). If you would like to change this IP address to something different you will need to change the PRIVATE_NET_IP variable in the Vagrantfile and the few wildcard DNS references to it in the two docker-compose.yml files.
Vagrant is set to allocate 4 cores and 4 GB of RAM, you may need to adjust this for your machine if necessary.
After deploying, Graylog takes the longest to become available and it may take 30 seconds to a few minutes to bring it up depending on your machine.

This project is a demonstration only and should not be used in a production environment.

Quick Start

This section assumes you will be using the default 172.28.128.30 IP address

Clone the repository and navigate inside its directory
Create and provision the VM using vagrant up
Navigate to http://graylog.172.28.128.30.xip.io:8080/
Login using admin for both the username and password.
Navigate to Inputs: System > Inputs
Select input GELF UDP and Launch new input
Check the Global option at the top and give it a name (e.g. Fluentd) then save it
Ensure it starts running automatically then click Show received messages
Press the start button on the top right to start updating the feed every second

Syslog Test

Go back to the terminal inside the project's directory and type vagrant ssh
You can test Syslog collection with logger e.g. logger -t test Hello world (or just wait for some to appear)

Docker Test

Generate Docker logs by simply navigating to the WordPress install page http://wordpress.172.28.128.30.xip.io:8080/

File Test

Collect logs from Apache's access_log file by going to http://172.28.128.30/

Copyrights and Licenses

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.

3.5 KiB Raw Blame History