How to Deploy Graylog on a VPS

copysudo ufw allow OpenSSH
sudo ufw allow 80
sudo ufw allow 443
sudo ufw --force enable
sudo ufw status verbose

copycurrent=$(sysctl -n vm.max_map_count)
echo "vm.max_map_count is $current"
if [ "$current" -lt 262144 ]; then
  echo "vm.max_map_count=262144" | sudo tee /etc/sysctl.d/99-graylog.conf
  sudo sysctl --system >/dev/null
fi
sysctl vm.max_map_count

#Get the official compose files

Clone the repository. The single-node, open-license stack lives in open-core/:

copycd ~
[ -d ~/graylog ] || git clone https://github.com/Graylog2/docker-compose ~/graylog
cd ~/graylog/open-core
grep -n 'image:' docker-compose.yml

It pins mongo:7.0, graylog/graylog-datanode:7.1 and graylog/graylog:7.1. Every port is already published on 127.0.0.1 only: the web UI and API on 9000, plus Beats, syslog, raw and GELF inputs. Nothing is reachable from outside until you choose to open it.

#Generate the secrets

The stack refuses to start without two values in .env:

• GRAYLOG_PASSWORD_SECRET peppers stored passwords and encrypts secrets in the database. The .env.example says to use at least 64 characters, and that changing it later invalidates sessions and encrypted values. Generate it once and back it up.
• GRAYLOG_ROOT_PASSWORD_SHA2 is the SHA-256 hash of the built-in admin user's password. Per the example file, this password can't be changed from the UI or the API, only here.

copycd ~/graylog/open-core
if [ ! -f .env ]; then
  openssl rand -base64 18 > admin-password
  chmod 600 admin-password
  printf 'GRAYLOG_PASSWORD_SECRET=%s\nGRAYLOG_ROOT_PASSWORD_SHA2=%s\n' \
    "$(openssl rand -hex 48)" \
    "$(tr -d '\n' < admin-password | sha256sum | cut -c1-64)" > .env
fi
chmod 600 .env
cut -d= -f1 .env

The admin password is in ~/graylog/open-core/admin-password. The secret is 96 hex characters.

Also tell Graylog its public URL, since the compose file hard-codes http://localhost:9000/. Use your real domain:

copycd ~/graylog/open-core
sed -i 's|GRAYLOG_HTTP_EXTERNAL_URI: "http://localhost:9000/"|GRAYLOG_HTTP_EXTERNAL_URI: "https://logs.example.com/"|' docker-compose.yml
grep -n GRAYLOG_HTTP_EXTERNAL_URI docker-compose.yml

#Start the stack

copycd ~/graylog/open-core
docker compose up -d
for i in $(seq 1 60); do
  docker compose logs graylog 2>&1 | grep -q "Initial configuration is accessible" && break
  sleep 5
done
docker compose ps

#First start: the preflight setup

With the Data Node, a fresh Graylog does not start fully on first boot. It starts a setup interface ("preflight") on port 9000, protected by a one-time password it prints to its log. In that interface you create a certificate authority and provision a TLS certificate for the Data Node. After that, Graylog restarts in normal mode. Until then, there is no search UI and no way to use the admin password you generated.

Find the one-time credentials in the log:

copycd ~/graylog/open-core
docker compose logs graylog 2>&1 | grep "Initial configuration is accessible" | sed "s/password '.*'/password '<shown in your log>'/"

Run it without the sed to see the actual password. Then tunnel to the loopback port from your own machine and open http://localhost:9000:

copyssh -L 9000:127.0.0.1:9000 deploy@SERVER_IP

Log in as admin with the one-time password, create a new CA, accept or adjust the certificate renewal policy, provision certificates for the detected Data Node, and resume startup.

If you'd rather stay in the terminal, the same four steps can be driven with the HTTP calls the setup page makes. These are what Graylog 7.1's preflight page sends. They aren't a documented public API, so prefer the UI if a later version behaves differently:

copycd ~/graylog/open-core
PRE=$(docker compose logs graylog 2>&1 | grep -o "password '[^']*'" | head -1 | cut -d"'" -f2)
api() { curl -s -u "admin:$PRE" -H 'X-Requested-By: cli' -H 'Content-Type: application/json' "$@"; }
api -X POST http://127.0.0.1:9000/api/ca/create -d '{"organization":"Graylog CA"}'; echo
api -X POST http://127.0.0.1:9000/api/renewal_policy -d '{"mode":"AUTOMATIC","certificate_lifetime":"P30D"}'
api -X POST http://127.0.0.1:9000/api/generate
for i in $(seq 1 30); do
  api http://127.0.0.1:9000/api/data_nodes | grep -q '"status":"CONNECTED"' && break
  sleep 5
done
api http://127.0.0.1:9000/api/data_nodes; echo
api -X POST http://127.0.0.1:9000/api/status/finish-config; echo

{"result":"FINISHED"} ends preflight. Graylog restarts into normal mode, and from then on admin uses the password you generated. Wait for it to report alive:

copycd ~/graylog/open-core
for i in $(seq 1 60); do
  [ "$(curl -s -o /dev/null -w '%{http_code}' -u "admin:$(tr -d '\n' < admin-password)" http://127.0.0.1:9000/api/system/lbstatus)" = 200 ] && break
  sleep 5
done
curl -s -u "admin:$(tr -d '\n' < admin-password)" http://127.0.0.1:9000/api/system | grep -o '"version":"[^"]*"\|"lifecycle":"[^"]*"'

#Send a test message

Graylog does nothing until an input exists. Create a global GELF UDP input on port 12201, which the compose file already publishes on 127.0.0.1. In the UI this is System → Inputs. From the shell, it's one call to the REST API:

copycd ~/graylog/open-core
AUTH="admin:$(tr -d '\n' < admin-password)"
curl -s -u "$AUTH" -H 'X-Requested-By: cli' -H 'Content-Type: application/json' \
  -X POST http://127.0.0.1:9000/api/system/inputs \
  -d '{"title":"GELF UDP","type":"org.graylog2.inputs.gelf.udp.GELFUDPInput","global":true,"configuration":{"bind_address":"0.0.0.0","port":12201}}'
echo
sleep 5
echo -n '{"version":"1.1","host":"vps","short_message":"hello from the VPS"}' | nc -u -w1 127.0.0.1 12201
sleep 15
curl -s -u "$AUTH" -H 'Accept: application/json' \
  "http://127.0.0.1:9000/api/search/universal/relative?query=hello&range=600&fields=message,source" \
  | grep -o '"total_results":[0-9]*'

"total_results":1 means the message went in through the input, was indexed by the Data Node, and came back from search.

#HTTPS + domain

Point an A record for logs.example.com at the server and put Caddy in front of the loopback port:

logs.example.com {
    reverse_proxy 127.0.0.1:9000
}

The GRAYLOG_HTTP_EXTERNAL_URI you set earlier must match this address, or the web interface will build its links for the wrong host.

Getting logs in from other machines. The inputs are bound to loopback, so only senders on this box can reach them. For remote senders, change the relevant 127.0.0.1: port mapping in docker-compose.yml (for example 12201:12201/udp), recreate the container, and then restrict that port with your provider's cloud firewall. Docker-published ports bypass ufw. Neither GELF UDP nor syslog UDP has authentication, so never leave them open to the world.

#Backups

MongoDB holds the configuration: users, inputs, streams, pipelines and dashboards. Dump it with the stack running:

copycd ~/graylog/open-core
docker compose exec -T mongodb mongodump --db graylog --archive --gzip > graylog-mongo-$(date +%F).archive.gz
ls -lh graylog-mongo-*.archive.gz

Keep .env (without the password secret, restored encrypted values become unreadable) and admin-password with it, off the box. The log messages themselves live in the graylog-datanode volume. For those, index retention and rotation (System → Indices) matter more than backups on a single VPS. If you need copies, archive the stopped volume or use OpenSearch snapshots to external storage.

#Upgrades

Change the Graylog and Data Node tags together, since their versions must match. Take a MongoDB dump, then:

copycd ~/graylog/open-core
docker compose pull
docker compose up -d

Read Graylog's upgrade notes before moving between major versions. Because upstream says the compose files "can change in incompatible ways", review git diff after a git pull in ~/graylog rather than applying it blind.

#Troubleshooting

Port 9000 asks for a password and the generated one fails. You are still in preflight. Use the one-time password from the log, not your own.

Preflight never sees the Data Node. Check docker compose logs datanode. The usual causes are a vm.max_map_count below 262144, or GRAYLOG_PASSWORD_SECRET differing between the two services. The compose file passes the same .env value to both, and the comments say it must match.

Containers restart or the host swaps. OpenSearch needs its memory. See the sizing section and check docker stats --no-stream.

Search shows nothing. Confirm the input is running (System → Inputs), the sender uses the right protocol (GELF UDP vs TCP), and the time range covers the message's timestamp.

#Verification + next steps

You're done when https://logs.example.com loads over a valid certificate, you can sign in as admin with your generated password, the test message is searchable, and a MongoDB dump sits off the box.

Next: set index rotation and retention under System → Indices, add a syslog or GELF input for your real hosts, and create a non-admin user for daily use. For error tracking rather than raw logs, see GlitchTip. For metrics, see Prometheus.