The dependable VPS layout for Graylog 7.2 is an Ubuntu 22.04 or 24.04 application node running MongoDB and Graylog Server, plus a separate node running Graylog Data Node. Graylog collects, enriches, stores and searches logs in one interface. The installation below uses Data Node, Graylog’s preferred data-management method, and keeps the services on private network paths wherever possible.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
You can operate OpenSearch yourself instead, but that adds another system to secure, upgrade and keep within Graylog’s compatibility matrix. Whichever backend you choose, size the nodes before installing, use XFS for log storage, and replace the installation guide’s permissive firewall assumptions with rules for your own source networks.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat you are installing
A production-style Graylog deployment has four logical parts:
- Graylog Server: the web interface, API, processing pipeline and input management.
- MongoDB: Graylog’s metadata database. It stores configuration and other application metadata rather than the bulk of indexed log messages.
- Graylog Data Node: Graylog’s preferred method for managing the search and storage layer.
- Log sources and clients: servers, applications, network devices and agents that send events to Graylog.
The current single-node Core instructions place MongoDB and Graylog Server together on one node and place Data Node on a separate node. Treat that as the baseline architecture for this guide. Keep MongoDB and Data Node reachable only over the private network; expose the Graylog web/API endpoint only to administrators and approved clients.
#1 Best Overall
Graylog 7.2 compatibility
| Component | Supported versions or guidance |
|---|---|
| Operating system packages | Debian 12; Ubuntu 22.04 or 24.04; RHEL-compatible 8 or 9; SLES 15 |
| MongoDB with Graylog 7.2 | MongoDB 7.x through 8.2.x |
| Self-managed OpenSearch with Graylog 7.2 | OpenSearch 1.1.x, or 2.0.x through 3.7.x |
| OpenSearch 3.x restriction | Use for new installations or upgrades that do not contain incompatible indices created before OpenSearch 2.0 |
This article uses Ubuntu 22.04/24.04 and the Data Node route. Do not upgrade MongoDB or a self-managed OpenSearch cluster outside the supported ranges simply because a newer package is available.
Choose Data Node or self-managed OpenSearch
| Decision | Data Node | Self-managed OpenSearch |
|---|---|---|
| Best fit | Default Graylog Core architecture; you want Graylog’s packaged data-management workflow | You deliberately need direct operational control of OpenSearch |
| Operational burden | Graylog supplies package and configuration steps for the data layer | You operate OpenSearch configuration, security, upgrades and compatibility yourself |
| Version discipline | Follow the Graylog Data Node instructions for your Graylog release | Pin to the Graylog 7.2 matrix: 1.1.x, 2.0.x–3.7.x, with the OpenSearch 3.x index caveat |
| Security work | Still required; the installation guide does not secure the environment for you | Required for both Graylog and OpenSearch, including OpenSearch security settings |
Choose Data Node unless managing OpenSearch directly is a stated requirement. The self-managed route is not a shortcut: it gives you control, but also makes version compatibility, index migration and security your responsibility.
Plan the VPS before installing
Use a supported Ubuntu release
Provision Ubuntu 22.04 or 24.04 for the package walkthrough. Debian 12, RHEL-compatible 8/9 and SLES 15 are also listed as supported package operating systems, but their repository and service commands differ. Start with a clean, fully updated VPS and record its private addresses before installing.
Separate the application and data roles
Put MongoDB and Graylog Server on the application node. Put Graylog Data Node on its own node as recommended by the Core layout. This separation prevents search and index activity from competing directly with Graylog’s processing and MongoDB metadata workload. If you are building a disposable lab, document any deviation so that a later migration does not surprise you.
Plan storage, filesystem and retention
Graylog strongly recommends XFS for the storage volume used by the data layer. Choose persistent block storage rather than an ephemeral VPS disk, and leave headroom for index growth, journal files, operating-system updates and temporary recovery work. A capacity plan should include your expected daily ingest, the number of retained days, replication or backup copies, and the free space required for index maintenance.
Size JVM heaps deliberately
The Graylog guidance recommends a Data Node heap of about half of the memory on its node, capped at 31 GB, and a Graylog heap of about half of the memory on its node, capped at 16 GB. Set each service’s minimum and maximum heap to the same value so the process does not resize unpredictably. These are documentation recommendations, not a promise that every ingest rate will fit; monitor memory pressure and storage latency after you begin collecting logs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Account for the message journal
The journal buffers messages when processing or indexing cannot keep up. Set its age and size for the outage window you actually need. Graylog’s example reserves roughly 72 hours and 90 GB for an ingest rate of 30 GB of logs per day:
message_journal_max_age = 72h
message_journal_max_size = 90gbThat example is a configuration illustration, not a universal sizing rule. If your measured daily volume changes, recalculate the required journal space and verify that the data disk still has recovery headroom.
Set the timezone
UTC avoids ambiguity across servers and daylight-saving changes. Set it before collecting events if UTC is appropriate for your operations:
sudo timedatectl set-timezone UTCIf your organization uses another timezone for operations, set that deliberately and keep the choice consistent in dashboards, alerting and incident procedures.
Map the network and firewall rules
Before starting services, list every connection that must work: administrators to the Graylog web/API endpoint, Graylog Server to MongoDB, Graylog Server to Data Node, and approved log sources to the Graylog inputs you create. Confirm reachability between the nodes using their private addresses. Do not publish MongoDB or Data Node ports to the internet.
The walkthrough binds Graylog’s HTTP service to 0.0.0.0:9000 as an example. That makes the service listen on every interface, so a cloud firewall and host firewall must restrict port 9000 to trusted administrator or VPN networks. A private interface address is safer when your network design permits it. Input ports depend on the protocols you enable; open only those specific ports and source ranges.
The installation documentation may assume firewalls are disabled to simplify first boot. Treat that as an installation convenience only. Replace it with explicit allow rules before production use, and verify that your provider’s security group, the VPS firewall and any host firewall agree.
Install MongoDB on the Graylog application node
1. Add the official MongoDB repository
Use MongoDB’s official repository for the Ubuntu release you selected and choose a MongoDB version in Graylog 7.2’s supported 7.x–8.2.x range. Avoid mixing packages from unrelated repositories; a mismatched server can leave Graylog unable to connect after an upgrade.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Enable and verify the service
After installing the repository package and MongoDB server package, enable MongoDB at boot and start it:
sudo systemctl enable --now mongod
sudo systemctl is-active mongodThe second command should return active. If it does not, inspect the service journal before proceeding. Check the MongoDB bind address and firewall so that only the Graylog application node can reach it. Do not expose the database listener publicly.
3. Record the MongoDB connection details
You will need the MongoDB URI when configuring Data Node and Graylog. Use the private hostname or address, the configured port, and the Graylog database name required by your deployment. Keep credentials and connection details in your secret-management process rather than in shared notes.
Install Graylog Data Node
Run these steps on the separate Data Node host.
1. Set the virtual-memory map limit
Data Node requires a vm.max_map_count value of at least 262144. Apply it immediately and persist it across reboots:
Recommended Free Tools
sudo sysctl -w vm.max_map_count=262144
echo 'vm.max_map_count=262144' | sudo tee /etc/sysctl.d/99-graylog-datanode.conf
sudo sysctl --systemConfirm the effective value with sysctl vm.max_map_count before starting the service.
2. Install the package
After configuring Graylog’s package repository for your Ubuntu release, install Data Node:
sudo apt-get update
sudo apt-get install graylog-datanode3. Configure the node and MongoDB URI
Edit the Data Node configuration installed by the package. Set the MongoDB connection to the private URI of the MongoDB service and configure the Data Node heap. Set the minimum and maximum heap values to the same amount, using roughly half of the Data Node host’s RAM and never exceeding the documented 31 GB cap. Ensure the node’s data path is on the planned XFS volume.
4. Generate the shared secret
Generate a long random value once and keep it available for the Graylog Server configuration:
openssl rand -hex 32Use the resulting value as Graylog’s password_secret. The value must match wherever Graylog requires it; changing it later can invalidate existing password-related data.
5. Start and verify Data Node
sudo systemctl enable --now graylog-datanode
sudo systemctl status graylog-datanodeDo not continue while the service is failing. Check its journal for an incorrect MongoDB URI, an insufficient map-count value, a missing data volume or a heap setting that exceeds available memory.
Install Graylog Server
Run the server installation on the application node that already has MongoDB.
1. Install Graylog Open
Configure Graylog’s official package repository for Ubuntu and install Graylog Open:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →sudo apt-get update
sudo apt-get install graylog-serverEnterprise or Security editions use their corresponding package instead; keep the package edition consistent with the license and repository you intend to operate.
Rank #4
2. Create the administrator password hash
Graylog’s root_password_sha2 setting expects a SHA-256 hash rather than the clear-text administrator password. Generate the hash in a controlled shell, for example:
printf '%s' 'your-long-admin-password' | sha256sumCopy only the resulting hexadecimal hash into root_password_sha2 in /etc/graylog/server/server.conf. Use a unique password stored in your password manager; do not reuse the VPS or cloud-account password.
3. Set the shared secret and MongoDB URI
In /etc/graylog/server/server.conf, set password_secret to the exact value generated for Data Node and set the MongoDB URI to the private MongoDB address. A secret mismatch between nodes can prevent a usable login or a healthy startup.
4. Configure the HTTP listener
Set an address that clients can reach, such as:
http_bind_address = 0.0.0.0:9000Use a restrictive firewall immediately if you bind to all interfaces. For production, plan encrypted access and a private or controlled ingress path rather than leaving an administrative interface broadly reachable.
5. Tune the journal and Graylog heap
Add the journal age and size appropriate for your measured ingest. The 72-hour/90-GB example applies only to an estimated 30 GB per day. Set Graylog’s minimum and maximum JVM heap to the same value, approximately half of the application node’s memory and no more than the documented 16 GB cap. Leave enough RAM for the operating system, MongoDB and file caching.
6. Start Graylog and read the first-start credentials
sudo systemctl enable --now graylog-server
sudo systemctl status graylog-server
sudo journalctl -u graylog-server -n 100Complete the documented first-start preflight login immediately. The initial credentials are written to the Graylog log; use them for that preflight step, then sign in with the administrator password represented by your configured root_password_sha2. If the service starts but the login fails, stop and resolve the configuration rather than repeatedly guessing passwords.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Verify the installation
Service checks
- MongoDB reports
activeon the application node. - Graylog Server reports
activeand its journal contains no repeating connection or authentication errors. - Data Node reports
activeon its host. - The configured private paths between Graylog, MongoDB and Data Node are reachable, while unintended public paths are blocked.
Web access
From an allowed administrator network, open the Graylog host on the configured port 9000. If you selected 0.0.0.0:9000, use the VPS address only through the firewall path you intended. A browser timeout usually indicates a bind address, cloud security-group or host-firewall problem; a login page followed by errors usually points to Graylog configuration or backend connectivity.
Prepare log inputs
Create inputs only for protocols and source networks you need. Start with one known source, confirm that events arrive and are searchable, then add additional sources. This staged approach makes it easier to distinguish an input-port problem from a processing, journal or storage problem.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure the VPS before production traffic
The Ubuntu and self-managed OpenSearch installation guides explicitly do not configure a secure environment for you. Complete these controls before treating the deployment as production-ready:
Best Value
- Restrict network access: allow the web/API endpoint only from administrator or VPN networks; allow MongoDB and Data Node traffic only between the required private hosts.
- Enable encryption: configure TLS for administrator access and for service or input paths where your threat model requires it. Do not assume the initial HTTP listener is encrypted.
- Configure authentication and authorization: use individual administrator accounts where available, apply least privilege and remove or disable accounts that are no longer needed.
- Protect secrets: keep
password_secret, database credentials and administrator credentials out of shell history, tickets and public repositories. - Back up metadata and configuration: include MongoDB metadata, Graylog configuration, certificates, dashboards and pipeline definitions in your recovery plan.
- Monitor the platform: alert on disk usage, journal growth, heap pressure, service restarts and failed backend connections.
Retention, capacity and upgrades
Use measured ingest rather than guesswork
Estimate daily log volume from actual sources, then choose retention and storage with room for index overhead and operational recovery. The documented 30-GB-per-day example produces 90 GB for 72 hours of journal capacity; it does not describe a market-wide requirement or guarantee a particular VPS size.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep heaps within their documented limits
Data Node’s approximately half-RAM recommendation is capped at 31 GB; Graylog’s is capped at 16 GB. Minimum and maximum values should match. Increasing a heap while leaving no memory for MongoDB, the operating system or filesystem cache can make the entire node less stable, not more capable.
Pin versions and schedule maintenance
Before upgrading Graylog, MongoDB, Data Node or self-managed OpenSearch, check the Graylog 7.2 compatibility ranges and the index-history restriction for OpenSearch 3.x. Test the upgrade with a backup and a rollback plan. Do not introduce OpenSearch 3.x into a cluster containing incompatible indices created before OpenSearch 2.0.
Troubleshooting common failures
Graylog Server will not start
Check sudo journalctl -u graylog-server for a malformed setting, an absent root_password_sha2, a missing password_secret, an unreachable MongoDB URI or a heap allocation that the host cannot satisfy. Correct one issue at a time and restart only after validating the file.
Data Node exits immediately
Verify sysctl vm.max_map_count is at least 262144, confirm the XFS data volume is mounted and writable, and check that the Data Node heap leaves memory for the operating system. Then inspect the Data Node service journal for its MongoDB connection and configuration errors.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The login page is unreachable
Confirm that Graylog is listening on the configured address and port, that the service is active, and that the VPS provider’s security group and host firewall allow port 9000 from your administrator network. A listener on 127.0.0.1 cannot be reached remotely; a listener on all interfaces without firewall restrictions is unsafe.
Login credentials are rejected
Read the first-start credentials from the Graylog log for the documented preflight login, then use the administrator password whose SHA-256 hash is in root_password_sha2. Check that the same password_secret was copied exactly and that no whitespace was introduced.
Messages accumulate in the journal
Journal growth means ingestion, processing or indexing is slower than arrival. Check Data Node health, disk free space, heap pressure, network reachability and input configuration. Do not simply increase the journal indefinitely: size it for a defined outage window and fix the bottleneck that is preventing drainage.
Container installation as an alternative
Graylog also publishes Graylog Open 7.2.0 Docker images, Docker Compose definitions, DEB/RPM packages, manual server downloads, bundled JVM builds and Sidecar. Containers can be appropriate when your team already operates Docker and has a tested persistence, networking, upgrade and backup process. The package route described here is easier to audit on a conventional VPS because the services, configuration files and systemd status are visible in the host’s normal administration workflow.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Final deployment checklist
- Ubuntu 22.04 or 24.04 is installed and patched.
- XFS-backed persistent storage is mounted for the data layer.
- MongoDB and Graylog Server share the application node; Data Node is on its planned separate node.
- MongoDB is in Graylog 7.2’s 7.x–8.2.x compatibility range.
- Data Node has
vm.max_map_countset to at least 262144. - Data Node and Graylog heaps have matching minimum and maximum values and remain under their documented caps.
- The generated
password_secretmatches the required Graylog configuration. root_password_sha2is set and the first-start preflight login has been completed.- The journal is sized from measured ingest and the intended outage window.
- Only required ports and source networks are allowed; internal services are not public.
- TLS, authentication, authorization, backups and monitoring are configured before production use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
