> For the complete documentation index, see [llms.txt](https://kchuene.gitbook.io/data-communication-project/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kchuene.gitbook.io/data-communication-project/archive/graylog.md).

# Graylog

Installed as an alternative to Wazuh, providing SIEM and Log Management.

## Pull the Repository

{% code overflow="wrap" lineNumbers="true" %}

```
git clone https://github.com/Graylog2/docker-compose.git graylog2-docker
cd graylog2-docker/open-core/
```

{% endcode %}

## Configuration

Set `vm.max_map_count=262144`.

{% code overflow="wrap" lineNumbers="true" %}

```
sysctl vm.max_map_count=262144 # minimum
sysctl vm.max_map_count
```

{% endcode %}

**Graylog Secret + SHA2 hash and Datanode Secret**

Create your password (minimum 16 chars) and hash:

{% code overflow="wrap" lineNumbers="true" %}

```
python3 -c "import secrets; print(secrets.token_urlsafe(16), end='');" | tee graylog-secret | shasum -a 256
```

{% endcode %}

{% hint style="info" %}
Option -n prevents output of training newline.
{% endhint %}

Edit `open-core/.env.example` and save a copy as `.env`:

{% code overflow="wrap" lineNumbers="true" %}

```
GRAYLOG_PASSWORD_SECRET="<GRAYLOG-SECRET-OUTPUT"
GRAYLOG_ROOT_PASSWORD_SHA2="<GRAYLOG-SECRET-OUTPUT-HASH>"
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```
cp .env.example .env
```

{% endcode %}

## Installation

Insure you are in the directory where the `docker-compose.yml` file is.

**Pull the images then Create + Run the containers**

{% code overflow="wrap" lineNumbers="true" %}

```
sudo docker compose -f docker-compose.yml pull
sudo docker compose -f docker-compose.yml up -d
```

{% endcode %}

## Access

View the `open-core-graylog` container logs, you should get the message for logging in like so

{% code overflow="wrap" lineNumbers="true" %}

```
It seems you are starting Graylog for the first time. To set up a fresh install, a setup interface has

been started. You must log in to it to perform the initial configuration and continue.

Initial configuration is accessible at 0.0.0.0:9000, with username 'admin' and password 'uftWTIPSaG'.

Try clicking on http://admin:uftWTIPSaG@0.0.0.0:9000
```

{% endcode %}

Visit the URL with your username and password for initial configuration

{% code overflow="wrap" lineNumbers="true" %}

```
http://admin:uftWTIPSaG@0.0.0.0:9000
```

{% endcode %}

**Initial Configuration**

You'll be taken through the following steps

* Configure a certificate authority
* Configure a renewal policy
* Provision certificates for your data nodes
* Configuration finished

after which you can "Resume Startup".

You'll be redirected to a login page where you can sign-in with username `admin` and the password saved in the `.env` file.

{% embed url="<https://go2docs.graylog.org/current/setting_up_graylog/server_configuration_settings_reference.htm>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://kchuene.gitbook.io/data-communication-project/archive/graylog.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.