Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesFor a new Graylog deployment on a VPS, use Ubuntu 22.04 or 24.04, MongoDB 7.x–8.2.x, and Graylog Data Node as the preferred storage layer. Keep Graylog and MongoDB on one VPS and place Data Node on a separate VPS for the documented Core architecture. Install the packages, set the required JVM and kernel limits, restrict the network, and complete the first-login preflight before sending production logs.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
Graylog collects, enriches, stores and analyzes logs in one searchable system. A practical Core deployment has three roles:
As an Amazon Associate I earn from qualifying purchases.
- Graylog server: the web interface, API, processing pipelines, inputs and alerting.
- MongoDB: Graylog’s metadata database. It stores configuration and other control-plane data, not the searchable log index itself.
- Graylog Data Node: the preferred data-management layer in Graylog’s current Core guide. It manages the search and storage backend used for log data.
The documented single-node pattern puts Graylog and MongoDB together and uses a separate Data Node. For a laboratory installation you may colocate services if your capacity and risk tolerance allow it, but separating the data tier gives you a cleaner failure boundary and makes storage growth easier to plan.
Choose the storage architecture before installing
Graylog Data Node (the default choice)
Choose Data Node for a new Graylog Core installation unless you have a specific operational reason to run the search engine yourself. Graylog supplies the package and configuration path, and the Core documentation describes Data Node as the preferred method for data management. You still need to size, secure, monitor and back up the VPS that hosts it.
#1 Best Overall
Self-managed OpenSearch
Run OpenSearch yourself only when your team deliberately needs direct control over that service’s lifecycle, topology or tuning. Graylog 7.2 supports OpenSearch 1.1.x and 2.0.x through 3.7.x in this mode. OpenSearch 3.x is intended for new installations or upgrades that do not contain incompatible indices created before OpenSearch 2.0. Pin the version in your deployment process; do not assume that the newest OpenSearch release is supported.
| Decision | Data Node | Self-managed OpenSearch |
|---|---|---|
| Best fit | Most new Graylog Core deployments | Teams requiring deliberate OpenSearch operational control |
| Search-layer installation | Use Graylog’s Data Node package and documented configuration | Install and operate OpenSearch separately, then connect Graylog to it |
| Graylog 7.2 compatibility | Follow the Data Node requirements for the selected Graylog release | OpenSearch 1.1.x or 2.0.x–3.7.x |
| Upgrade caveat | Follow Graylog’s Data Node upgrade procedure | OpenSearch 3.x cannot be treated as a universal in-place upgrade when pre-2.0 indices are present |
Supported operating systems and versions
For this VPS walkthrough, use Ubuntu 22.04 or Ubuntu 24.04. Graylog’s supported package operating systems also include Debian 12, RHEL-compatible 8 and 9, and SLES 15. Official Docker images are another supported delivery format.
| Component | Supported versions relevant to Graylog 7.2 | Qualification |
|---|---|---|
| Ubuntu | 22.04 or 24.04 | Recommended choices for this package-based VPS guide |
| MongoDB | 7.x through 8.2.x | Compatibility range listed for Graylog 7.2 |
| Self-managed OpenSearch | 1.1.x, or 2.0.x through 3.7.x | OpenSearch 3.x is for new installations or compatible upgrades without indices created before OpenSearch 2.0 |
Keep the Graylog, MongoDB and search-layer versions inside this matrix. A package that installs successfully can still be an unsupported combination.
Plan VPS capacity, storage and retention
Memory and JVM heaps
Graylog’s guide does not publish one universal VPS size because memory demand depends on ingest rate, pipeline work, searches and retention. Size from your expected workload, then apply the documented heap guidance:
- Allocate the Data Node heap at about half of the host’s system memory, capped at 31 GB.
- Allocate the Graylog JVM heap at about half of the host’s system memory, capped at 16 GB.
- Set each service’s minimum and maximum heap to the same value so the JVM does not resize the heap during operation.
- Leave the remainder for the operating system, filesystem cache, MongoDB, buffers and service overhead. Do not give all physical RAM to a heap.
These are Graylog configuration recommendations and limits, not market-wide sizing statistics. If the VPS runs MongoDB and Graylog together, account for both services before choosing the heap values.
Storage and filesystem
Plan storage from daily ingest, retention and recovery headroom rather than from the VPS disk advertised price. Graylog strongly recommends XFS for the storage volume. Keep the Data Node’s index and journal capacity separate from the operating system volume where practical, and monitor free space continuously.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Journal sizing
The message journal buffers messages when downstream processing or storage is unavailable. Size it for the outage window you can tolerate. Graylog’s example uses message_journal_max_age = 72h and message_journal_max_size = 90gb for an expected 30 GB of logs per day. The 90 GB figure follows from retaining roughly three days at that ingest rate; use your own measured rate instead of copying the example blindly.
Prepare the network and firewall
Before installing packages, map traffic between the Graylog server, MongoDB, Data Node or self-managed OpenSearch, administrators and log-producing clients. The web/API listener in the package example is TCP port 9000 when you set http_bind_address = 0.0.0.0:9000. Graylog input ports depend on the inputs you create, so open only the protocols and ports your senders actually use.
- Permit administrator access to the Graylog web/API listener only from trusted management networks or through a private access path.
- Permit Graylog-to-MongoDB traffic only between the application and database hosts.
- Permit Graylog-to-Data-Node or Graylog-to-OpenSearch traffic only between the required service addresses.
- Permit each log source to reach only its assigned Graylog input.
- Deny direct public access to MongoDB, Data Node and OpenSearch management endpoints.
The installation guide assumes a permissive firewall for convenience; that is not a production security posture. Replace the temporary allowance with explicit rules and source networks before exposing the service to real logs.
Install Graylog on Ubuntu, step by step
1. Provision the hosts
Create an Ubuntu 22.04 or 24.04 VPS for Graylog and MongoDB. Provision a separate Ubuntu VPS for Data Node when following the documented Core layout. Attach XFS-backed storage to the data host, record private addresses or DNS names, and confirm that the hosts can reach one another on the service paths you planned.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Set a consistent timezone if UTC is appropriate for your operations:
sudo timedatectl set-timezone UTCUsing one timezone across Graylog, its data tier and your log sources makes event timelines and retention investigations easier. If you use another timezone, apply it consistently and document the choice.
Rank #4
2. Install and verify MongoDB
On the Graylog host, install a MongoDB version in the Graylog 7.2 compatibility range (7.x through 8.2.x) from MongoDB’s official repository for your Ubuntu release. Enable the mongod service and verify that it is active before moving on. MongoDB is the metadata dependency, so a Graylog service that cannot reach it will not complete normal startup.
- Use a private bind address and network policy; do not publish the database to the internet.
- Record the MongoDB connection URI you will place in Graylog’s configuration.
- Test name resolution and connectivity from the Graylog process host, not only from your administrator workstation.
3. Prepare the Data Node host
Perform these tasks on the separate Data Node VPS:
- Set
vm.max_map_countto at least262144, apply the kernel setting and verify it remains in effect after reboot. - Install the
graylog-datanodepackage using Graylog’s Ubuntu package instructions. - Generate a long random secret. The documented command is:
openssl rand -hex 32- Save the generated value in your deployment secret store. You will use the same
password_secretvalue in the Graylog server configuration. - Configure the Data Node’s connection to the MongoDB-backed Graylog installation as required by the package guide.
- Set the Data Node JVM heap to the value calculated in your capacity plan, keeping its minimum and maximum equal.
- Enable and start
graylog-datanode, then inspect its service status and logs for configuration or connectivity errors.
Do not treat a running systemd unit as proof that the node is ready. Confirm that the Graylog host can reach it and that the Data Node has completed its own initialization.
4. Install Graylog Open on the Graylog host
Install Graylog Open with:
sudo apt-get install graylog-serverEnterprise or Security editions use their corresponding package instead. Edit /etc/graylog/server/server.conf and set the following values:
password_secret: paste the exact secret generated for the deployment. Every Graylog server in the same logical installation must use the matching value.root_password_sha2: set the SHA-256 hash of the administrator password you intend to use. Store the clear-text password in your password manager, not in the configuration file or shell history.mongodb_uri: point Graylog at the MongoDB instance you installed and secured.http_bind_address: choose the interface and port that should accept the web/API traffic, such as0.0.0.0:9000when the firewall limits access to trusted networks.message_journal_max_ageandmessage_journal_max_size: set them from your outage and ingest calculations, not from the example unless your workload matches it.
Set the Graylog JVM minimum and maximum heap to the same planned value, with the 16 GB cap and approximately half-memory guideline in mind. Enable and start graylog-server, then read the service log until startup completes.
Best Value
5. Complete the first-login preflight
Immediately after the first start, follow Graylog’s documented preflight procedure. The initial credentials needed for that preflight are printed in the Graylog log; use them as directed, then sign in with the administrator password represented by your configured root_password_sha2. Change any temporary credential the procedure requires and verify that the web interface, Data Node connection and MongoDB connection are all healthy before creating inputs.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Configure inputs and begin collecting logs
After the preflight, create inputs for the protocols your systems actually emit. Give each input a clear name, bind it to the intended interface, and document its listening port and source network. Start with one non-production sender so you can validate parsing, timestamps, fields and search behavior before opening the input to every host.
- Confirm that the sender can reach the Graylog input through the firewall.
- Check that events arrive with the expected timezone and timestamp field.
- Use streams, pipelines or extractors only after you can see the raw event; premature parsing can hide whether the transport itself works.
- Set retention and index rotation policies to match the disk and journal calculations.
Secure the installation before production use
The Ubuntu installation guide does not configure security for you. The same warning applies to the self-managed OpenSearch guide. Treat a successful package installation as an unprotected starting point.
Network controls
- Keep MongoDB, Data Node and OpenSearch on private addresses where possible.
- Allow the Graylog web/API port only from administrators, a reverse proxy or a private access network.
- Limit log-input sources to known address ranges and remove temporary broad rules.
- Use host and cloud firewalls together so a mistake in one layer does not expose the backends.
Encryption and identity
- Enable TLS for administrator access, log transport and internal service connections where supported by your chosen topology.
- Configure authentication and role-based authorization before granting non-administrators access.
- Protect the
password_secret, database credentials and administrator password in a secrets system with controlled access. - Audit administrative logins and review permissions as teams and integrations change.
Updates and backups
Pin Graylog, MongoDB and OpenSearch or Data Node versions to the compatibility matrix, test upgrades on a copy of the configuration, and keep rollback packages available. Back up Graylog configuration and MongoDB metadata, and design a separate recovery process for the indexed log data. A backup that restores only the web configuration does not recreate historical search results.
Operational checks after installation
Make these checks part of your first-day runbook:
- Graylog, MongoDB and Data Node services remain active after a reboot.
- The configured web/API listener is reachable only from approved networks.
- A test event can travel from sender to input, processing, storage and search.
- Journal age and size remain below their limits during normal ingest.
- Data Node disk usage, JVM heap and system memory have alert thresholds.
- Clock and timezone settings are consistent across senders and servers.
- Restore procedures have been tested rather than merely documented.
Troubleshoot common installation failures
| Symptom | Likely area | What to check |
|---|---|---|
| Graylog does not start | Configuration or dependency failure | Read the Graylog service log, validate server.conf, confirm the MongoDB URI, confirm the secret and password hash are present, and verify the selected heap fits the VPS. |
| Graylog starts but cannot use the data tier | Data Node/OpenSearch reachability or version | Check private-network routes, firewall rules, service status, kernel vm.max_map_count, heap allocation and compatibility with Graylog 7.2. |
| Web interface is unreachable | Bind address or firewall | Confirm http_bind_address, that Graylog is listening on the chosen port, and that the rule permits your source network without exposing the service publicly. |
| Events never arrive | Input, sender or network path | Verify the input is running, the sender uses the matching protocol and port, and each intervening firewall allows the sender’s address. |
| Journal fills rapidly | Ingest exceeds processing or storage capacity | Measure daily ingest, inspect Data Node and Graylog heap pressure, check disk free space, and resize the journal or service capacity only after identifying the bottleneck. |
| Search data disappears after an upgrade | Unsupported search-engine transition | Review the OpenSearch compatibility rule, especially whether indices were created before OpenSearch 2.0, and restore the last supported version or follow the documented migration path. |
Container deployment as an alternative
Graylog’s downloads provide Graylog Open 7.2.0 Docker images, Docker Compose files, DEB and RPM packages, manual server downloads, bundled JVM builds and Sidecar. Containers can simplify repeatable provisioning, but they do not remove the need to size persistent storage, configure MongoDB and the data tier, set kernel limits on the host, restrict network access or manage upgrades. Use the package path above when you want a conventional Ubuntu VPS service layout; choose Compose when your team already operates containerized workloads and has a tested persistence and backup process.
Quick Recap
Production readiness checklist
- Ubuntu 22.04 or 24.04 is installed and consistently time-zoned.
- MongoDB is within the Graylog 7.2 compatibility range and is reachable only from required hosts.
- Data Node is installed on its planned host, uses XFS-backed storage where possible, and has
vm.max_map_countof at least262144. - Graylog and Data Node heaps follow the half-memory guidance, their minimum and maximum values match, and the caps are respected.
- The journal age and size reflect measured ingest and the outage window you need.
- The Graylog web/API listener and log inputs have explicit source-restricted firewall rules.
- TLS, authentication, authorization, secret storage, backups and upgrade rollback procedures are configured.
- A real test event has been traced from sender to searchable result, and monitoring is alerting on service failure, disk pressure and memory pressure.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
