Arch Linux User Repository

Hi Mike,

regarding your request to define mongodb as a dependency rather than an optional dependency, I decided against it.

My reasons are, that MongoDB is no longer included in the official Archlinux repositories but also only in the Archlinux AUR.

I would like to let the end user decide whether to use the maximum version 7.x given by Graylog or a more current version such as 8.x.

The AUR package mongodb70-bin is built from the sources of Ubuntu 20.04 and Ubuntu 20.04 is already EOL.

So, please decide by youerself, which mongodb version is the best for you.

Greetings

Hi Mike,

I will adapt this for the next release.

Eight years ago...

Nothing4You commented on 2017-05-16 16:51 (SAST) Since graylog.service depends on mongodb.service that shouldn't be an optional dependency.

could you please add checksums for graylog-tmpfiles.conf and graylog.service?

I updated to latest version. When I try to start the service shows this message in "systemctl status graylog":

systemd[1]: graylog.service: Scheduled restart job, restart counter is at 1. systemd[1]: Stopped Graylog management server. systemd[1]: Started Graylog management server. java[921684]: WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance. systemd[1]: graylog.service: Scheduled restart job, restart counter is at 5. systemd[1]: Stopped Graylog management server. systemd[1]: graylog.service: Start request repeated too quickly. systemd[1]: graylog.service: Failed with result 'exit-code'. systemd[1]: Failed to start Graylog management server.

You could see below detailed information on journalctl with 5 attempt to start service:

03/02/2021 16:34 polkitd Operator of unix-session:2 successfully authenticated as unix-user:usuario to gain TEMPORARY authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.6959 [systemctl stop graylog] (owned by unix-user:usuario) 03/02/2021 16:34 polkit-kde-authentication-agent-1 Message of action: "Authentication is required to start 'graylog.service'." 03/02/2021 16:34 kernel audit: type=1130 audit(1612380861.827:93386): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 polkitd Operator of unix-session:2 successfully authenticated as unix-user:usuario to gain TEMPORARY authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.6963 [systemctl start graylog] (owned by unix-user:usuario) 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 java 2021-02-03 16:34:24,041 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,044 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,045 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,046 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,046 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,067 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 1. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 java 2021-02-03 16:34:25,718 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,721 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,722 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,723 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,723 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,735 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 2. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 java 2021-02-03 16:34:27,407 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,409 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,410 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,410 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,411 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 kernel audit: type=1131 audit(1612380867.430:93422): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 java 2021-02-03 16:34:27,422 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 3. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 kernel audit: type=1130 audit(1612380867.647:93423): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 kernel audit: type=1131 audit(1612380867.647:93424): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 kernel audit: type=1130 audit(1612380867.650:93425): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 java 2021-02-03 16:34:29,056 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,058 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,059 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,060 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,060 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,071 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 4. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 java 2021-02-03 16:34:30,782 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,785 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,786 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,786 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,786 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,796 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 5. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 systemd graylog.service: Start request repeated too quickly. 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 systemd Failed to start Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

Thanks.

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=graylog#n52

This line includes an extra = for the sed inplace replacement for message_journal_dir.

Which forms the configuration to be:

message_journal_dir = = /var/lib/graylog/data/journal

the plugin directory from the source .tgz should be included under /usr/lib/graylog/plugin

I would suggest using the following in the systemd service

ExecStart=/usr/bin/java -Djava.net.preferIPv6Addresses=true -Djava.library.path=/usr/lib/graylog/lib/sigar -Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -jar /usr/lib/graylog/server.jar server -f /etc/graylog/server/server.conf -p /run/graylog/server.pid
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=graylog

and then users of this package can use syslog-ng to capture the graylog output to a specific file using filters in syslog-ng.conf.

As well, I found that running service as nobody doesn't work, but rather using root. I suppose a better way is to create a specific user/group for this service.