Graylog4.2集群部署完整教程( 三 ) _Graylog

文章插图

(图片可点击放大查看)
2、修改graylog的主配置文件server.conf主节点graylog01的配置如下

/etc/graylog/server/server.conf cat /etc/graylog/server/server.conf | grep -v "^#" | grep -v "^$"is_master = truenode_id_file = /etc/graylog/server/node-idpassword_secret = XC0Epiv5SnWFdm82nsUWAJN3t2MHaFEaSFHd6RLPf1nzxwnmubT0n7NQdrK8jCDEOS05DtrkGHDDE61490OUJKBOOXIAT4LIroot_password_sha2 = 10dfabb9595634675701865aa1c6e774d89d59f4a104ab128fbffcdaa3cf8f7broot_timezone = Asia/Shanghaibin_dir = /usr/share/graylog-server/bindata_dir = /var/lib/graylog-serverplugin_dir = /usr/share/graylog-server/pluginhttp_bind_address = 192.168.31.211:9000http_publish_uri = http://192.168.31.211:9000/elasticsearch_hosts = http://graylog01:9200,http://graylog02:9200,http://graylog03:9200rotation_strategy = countelasticsearch_max_docs_per_index = 20000000elasticsearch_max_number_of_indices = 20retention_strategy = deleteelasticsearch_shards = 4elasticsearch_replicas = 0elasticsearch_index_prefix = graylogallow_leading_wildcard_searches = falseallow_highlighting = trueelasticsearch_analyzer = standardoutput_batch_size = 500output_flush_interval = 1output_fault_count_threshold = 5output_fault_penalty_seconds = 30processbuffer_processors = 8outputbuffer_processors = 16processor_wait_strategy = blockingring_size = 65536inputbuffer_ring_size = 65536inputbuffer_processors = 2inputbuffer_wait_strategy = blockingmessage_journal_enabled = truemessage_journal_dir = /var/lib/graylog-server/journallb_recognition_period_seconds = 3mongodb_uri = mongodb://graylog:Graylog2021@graylog01:27017,graylog02:27017,graylog03:27017/graylog?replicaSet=graylog-rsmongodb_max_connections = 1000mongodb_threads_allowed_to_block_multiplier = 5proxied_requests_thread_pool_size = 32

文章插图

(图片可点击放大查看)
3、重启graylog-server服务，并开放9000 web端口建议将配置文件scp到graylog02和graylog03上

文章插图

(图片可点击放大查看)
firewall-cmd --add-port=9000/tcp --permanent --zone=public firewall-cmd --reloadsystemctl restart graylog-server

文章插图

(图片可点击放大查看)
graylog02,graylog03节点修改如下三处即可
is_master = truehttp_bind_address = 192.168.31.213:9000http_publish_uri = http://192.168.31.213:9000/

文章插图

(图片可点击放大查看)
登录Graylog主界面查看GrayLog集群情况1、查看Nodes信息

文章插图

(图片可点击放大查看)
2、查看Cluster信息

文章插图

(图片可点击放大查看)
3、添加Input ，可以设置成全局的Input记得三台几点防火墙开放Input设置的端口，例如syslog1514
firewall-cmd --add-port=1514/udp --permanent --zone=public firewall-cmd --reload

文章插图

(图片可点击放大查看)

文章插图

(图片可点击放大查看)
Tips：修改graylog的jvm内存大小

文章插图

(图片可点击放大查看)

文章插图

(图片可点击放大查看)
本文参考如下链接完成

https://docs.graylog.org/v1/docs/multinode-setuphttps://docs.mongodb.com/manual/tutorial/deploy-replica-set/https://docs.mongodb.com/manual/tutorial/deploy-replica-set-with-keyfile-access-control/#std-label-deploy-repl-set-with-authhttps://cloud.tencent.com/developer/article/1615815https://zhuanlan.zhihu.com/p/120698020https://www.cnblogs.com/opsdemo/p/15035379.html