[P]Delete

Required Graylog version: 2.0 and later + installed graylog-plugin-collector (this plugin available in install package - folder plugins) The Graylog Collector Sidecar is a supervisor process for 3rd party log collectors like NXLog. The Sidecar program is able to fetch configurations from a Graylog server and render them as a valid configuration file for various log collectors. You can think of it like a centralized configuration management system for your log collectors. Download Graylog Collector Sidecar at https://github.com/Graylog2/collector-sidecar/releases Installation Download a package and install it on the target system. Ubuntu Install the NXLog package from the offical download page   $ sudo /etc/init.d/nxlog stop   $ sudo update-rc.d -f nxlog remove   $ sudo gpasswd -a nxlog adm   $ sudo dpkg -i collector-sidecar_0.0.8-1_amd64.deb Edit /etc/graylog/collector-sidecar/collector_sidecar.yml, you should set at least the correct URL to your Gra...

Manual Setup 1. Install Java with version above 1.7 2. Download the latest collector release. (find download links in the collector repository README) 3. Unzip collector tgz file to target location and rename     /opt/graylog-collector 4. cp config/collector.conf.example to config/collector.conf     /opt/graylog-collector/config 5. Update server-url in collector.conf to correct Graylog server address (required for registration) 6. Update file input configuration with the correct log files 7. Update outputs->gelf-tcp with the correct Graylog server address (required for sending GELF messages) 8. Start command cd /op/graylog-collector bin/graylog-collector run -f config/collector.conf 9. Login web interface and create new input gelf-tcp port 12201 Sample configure #  vi /opt/graylog-collector/config/collector.conf server-url = "http://10.10.10.10:12900" collector-id = "file:config/collector-id" host-name = "srv-web-06" inputs { ...

Graylog is an open-source log management tool. Similar to Splunk and LogStash, Graylog helps centralize and aggregate all your log files for full visibility. It also provides a query language to search through log data. For large volumes of log data in a big production setup, you might want to deploy a Graylog Cluster. Graylog Cluster consists of several components: Graylog server  - Log processor Graylog web UI  - Graylog web user interface MongoDB  - store configuration and the dead letter messages ElasticSearch  - store messages (if you lose your ElasticSearch data, the messages are gone) In this blog post, we are going to deploy a Graylog cluster, with a MongoDB Replica Set deployed using ClusterControl. We will configure the Graylog cluster to be able to collect syslog from several devices through a load balanced syslog TCP running on HAProxy. This is to allow high availability single endpoint access with auto failover in case if any of the Graylog...