https://wiki.tsnocode.dev/index.php?action=history&feed=atom&title=Graylog-sidecar_setup 2026-04-11T12:37:12Z Revision history for this page on the wiki MediaWiki 1.37.0 https://wiki.tsnocode.dev/index.php?title=Graylog-sidecar_setup&diff=6498&oldid=prev 2022-03-03T13:47:40Z

<p>Skrevet guide fra docs over</p> <p><b>New page</b></p><div>Start i Graylog.<br /> <br /> * Sæt et nyt index op (System &gt; Indices)<br /> * Sæt et nyt Stream op (Streams)<br /> ** Tilføj en regel om at &lt;code&gt;filebeat_collector_node_id&lt;/code&gt; skal matche &lt;code&gt;node_name&lt;/code&gt; (sat længere nede)<br /> ** Start stream<br /> * Opret en &lt;code&gt;server_api_token&lt;/code&gt; (System &gt; Users and Teams &gt; Sidecar System User (built-in) &gt; Edit tokens)<br /> <br /> Installer sidecar og collector på den nye node<br /> <br /> * Installer graylog-sidecar (original: https://docs.graylog.org/docs/sidecar)<br /> ** &lt;code&gt;sudo rpm -Uvh &lt;nowiki&gt;https://packages.graylog2.org/repo/packages/graylog-sidecar-repository-1-2.noarch.rpm&lt;/nowiki&gt;&lt;/code&gt;<br /> ** &lt;code&gt;sudo yum install graylog-sidecar&lt;/code&gt;<br /> * Ret opsætningen<br /> ** &lt;code&gt;sudo nano /etc/graylog/sidecar/sidecar.yml&lt;/code&gt;<br /> ** Sæt &lt;code&gt;node_name&lt;/code&gt; på sidecar.<br /> ** Sæt &lt;code&gt;server_url&lt;/code&gt; til &lt;nowiki&gt;https://graylog.tempusserva.dk&lt;/nowiki&gt;<br /> ** Sæt &lt;code&gt;server_api_token&lt;/code&gt;<br /> ** Sæt &lt;code&gt;send_status&lt;/code&gt; til true<br /> ** Tilføj tomcat logs til &lt;code&gt;list_log_files&lt;/code&gt; (fx til: “/usr/share/tomcat8/logs/”)<br /> * Sæt graylog-sidecar til at starte automatisk<br /> ** &lt;code&gt;sudo graylog-sidecar -service install&lt;/code&gt;<br /> ** &lt;code&gt;sudo systemctl start graylog-sidecar&lt;/code&gt; eller &lt;code&gt;sudo /etc/init.d/graylog-sidecar start&lt;/code&gt;<br /> * Installer filebeat (original: https://www.elastic.co/guide/en/beats/filebeat/7.16/setup-repositories.html#_yum)<br /> ** &lt;code&gt;sudo rpm --import &lt;nowiki&gt;https://packages.elastic.co/GPG-KEY-elasticsearch&lt;/nowiki&gt;&lt;/code&gt;<br /> * Tilføj repo<br /> ** &lt;code&gt;sudo nano /etc/yum.repos.d/elastic.repo&lt;/code&gt;<br /> ** Paste:<br /> *** &lt;code&gt;[elastic-7.x]&lt;/code&gt; &lt;code&gt;name=Elastic repository for 7.x packages&lt;/code&gt; &lt;code&gt;baseurl=&lt;nowiki&gt;https://artifacts.elastic.co/packages/oss-7.x/yum&lt;/nowiki&gt;&lt;/code&gt; &lt;code&gt;gpgcheck=1&lt;/code&gt; &lt;code&gt;gpgkey=&lt;nowiki&gt;https://artifacts.elastic.co/GPG-KEY-elasticsearch&lt;/nowiki&gt;&lt;/code&gt; &lt;code&gt;enabled=1&lt;/code&gt; &lt;code&gt;autorefresh=1&lt;/code&gt; &lt;code&gt;type=rpm-md&lt;/code&gt;<br /> * Installer<br /> ** &lt;code&gt;sudo yum install filebeat&lt;/code&gt;<br /> ** &lt;code&gt;sudo chkconfig --add filebeat&lt;/code&gt;<br /> <br /> Giv ny sidecar’s IP adgang til at forbinde, i apache og amazon. (Find med &lt;code&gt;wget -qO - &lt;nowiki&gt;https://icanhazip.com&lt;/nowiki&gt;)&lt;/code&gt;<br /> <br /> Tilføj en Collector i graylog (System &gt; Sidecars &gt; [&lt;code&gt;node_name&lt;/code&gt;] &gt; Manage sidecar)<br /> <br /> * Sæt hak ud for Filebeat<br /> * Klik på Configure oppe til højre<br /> * Sæt hak ud for den korrekte config<br /> * Gem.<br /> <br /> Sæt alerts op<br /> <br /> * Filter search-query:<br /> ** &lt;code&gt;(message:/.*[A-Za-z0-9]Exception.*/ OR Severity:SEVERE) AND NOT message:&quot;Context is read only&quot; AND NOT message:&quot;SEVERE: null&quot; AND NOT msg:&quot;&lt;&quot; AND NOT msg:/.*(protocol|target|name) \[.*/ AND NOT Thread:/http-nio-.*/ AND NOT msg:/Failed to start connector.*/ AND NOT msg:/Invalid Addresses/ AND NOT msg:/com.sun.mail.smtp.SMTPAddressFailedException: 450 4.7.1.*/&lt;/code&gt;</div>

Tvi