Observability · 2026-07-28 · 12 min read

Install Graylog Open on Debian with Data Node

This guide offers a native Debian 12 x86_64 route and a Docker Compose route for Debian 12 or 13. It keeps public exposure, DNS, TLS and firewall policy under the administrator’s control.

Choose the supported route

Graylog uses MongoDB for metadata and Graylog Data Node to manage the compatible OpenSearch backend. Data Node is the recommended current architecture; do not add a separate OpenSearch 3 installation.

Native: Debian 12, x86_64 and AVX only. MongoDB Community does not currently list Debian 13 for its official APT packages.
Docker Compose: Debian 12 or 13 on x86_64 or ARM64, after Docker Engine and Compose are installed.
Use at least 4 GiB RAM, 2 vCPU and 20 GiB free space. Eight GiB, four vCPU and 50 GiB are a practical starting point.

Run the preflight first

The preflight checks the operating system, architecture, CPU compatibility, capacity, ports, existing services, vm.max_map_count and the pinned MongoDB image. It stops before changing the host when a condition is incompatible.

curl -fsSL https://scripts.lrq.lat/graylog/v1.0.0/install.sh | sudo bash

Starts the portable interactive menu. Choose Docker Compose for Debian 13 or ARM64.

curl -fsSL https://scripts.lrq.lat/graylog/v1.0.0/install.sh | sudo bash -s -- preflight --mode docker

Runs only the Docker compatibility checks without creating the stack.

Install with Docker Compose

Install Docker Engine and the modern Compose plugin first. The installer writes a restricted configuration below /opt/lrqnet/graylog, uses persistent volumes and pins each image by OCI digest. It binds the web interface to localhost by default.

curl -fsSL https://scripts.lrq.lat/graylog/v1.0.0/install.sh | sudo bash -s -- install --mode docker

Runs preflight, asks for the initial administrator password without echoing it, generates the shared password secret and starts MongoDB, Data Node and Graylog.

ssh -L 9000:127.0.0.1:9000 admin@graylog-host

Creates a local SSH tunnel so the private Graylog interface can be opened at http://127.0.0.1:9000 without exposing port 9000 on the network.

Manual and safe Docker Compose installation

Use this reviewed route when a one-line installer is not acceptable. It is the manual path for Debian 12 and 13 on x86_64 or ARM64. It keeps the initial interface private and deliberately does not configure DNS, TLS or firewall rules.

sudo sysctl -w vm.max_map_count=262144
printf 'vm.max_map_count=262144\n' | sudo tee /etc/sysctl.d/99-graylog.conf >/dev/null
sudo docker compose version

Sets the kernel map-count requirement persistently in a dedicated file and confirms that the modern Compose plugin is available. Do not continue if the host has less than 4 GiB RAM, two vCPUs or 20 GiB free space.

sudo install -d -m 0750 /opt/lrqnet/graylog
read -rsp 'Initial Graylog administrator password: ' GRAYLOG_ADMIN_PASSWORD; printf '\n'
read -rsp 'Confirm password: ' GRAYLOG_ADMIN_PASSWORD_CONFIRM; printf '\n'
[ "$GRAYLOG_ADMIN_PASSWORD" = "$GRAYLOG_ADMIN_PASSWORD_CONFIRM" ] || { echo 'Passwords do not match' >&2; exit 1; }
[ "${#GRAYLOG_ADMIN_PASSWORD}" -ge 12 ] || { echo 'Use at least 12 characters' >&2; exit 1; }
GRAYLOG_PASSWORD_SECRET="$(openssl rand -hex 48)"
GRAYLOG_ROOT_PASSWORD_SHA2="$(printf '%s' "$GRAYLOG_ADMIN_PASSWORD" | sha256sum | awk '{print $1}')"
unset GRAYLOG_ADMIN_PASSWORD GRAYLOG_ADMIN_PASSWORD_CONFIRM

Creates a restricted directory, asks for the administrator password without echoing it, validates it locally, generates Graylog's shared secret and derives the SHA-256 value required by Graylog. The password is not written to shell history or the Compose file.

yaml

services:
  mongodb:
    image: mongo:8.0.16@sha256:4b58ebcb1dc7a7b4e84cd8ce9098d48764ae4478876898ff9551acf2ac4a6a6d
    restart: unless-stopped
    volumes: [mongodb-data:/data/db]
  datanode:
    image: graylog/graylog-datanode:7.1.6-1@sha256:4867cd8ad09ee7a129c0898fe326b0b638928d984789072eb3640fef42fccf5d
    restart: unless-stopped
    depends_on: [mongodb]
    environment:
      GRAYLOG_DATANODE_PASSWORD_SECRET: ${GRAYLOG_PASSWORD_SECRET}
      GRAYLOG_DATANODE_ROOT_PASSWORD_SHA2: ${GRAYLOG_ROOT_PASSWORD_SHA2}
      GRAYLOG_DATANODE_MONGODB_URI: mongodb://mongodb:27017/graylog
      GRAYLOG_DATANODE_OPENSEARCH_HEAP: 2g
    volumes: [datanode-data:/var/lib/graylog-datanode]
  graylog:
    image: graylog/graylog:7.1.6-1@sha256:b9a4fd841e4c49c148043265f579554a3bdadf8137ff381b686c194ccb9a3365
    restart: unless-stopped
    depends_on: [mongodb, datanode]
    environment:
      GRAYLOG_PASSWORD_SECRET: ${GRAYLOG_PASSWORD_SECRET}
      GRAYLOG_ROOT_PASSWORD_SHA2: ${GRAYLOG_ROOT_PASSWORD_SHA2}
      GRAYLOG_MONGODB_URI: mongodb://mongodb:27017/graylog
      GRAYLOG_HTTP_BIND_ADDRESS: 0.0.0.0:9000
      GRAYLOG_HTTP_EXTERNAL_URI: http://127.0.0.1:9000/
    ports: ["127.0.0.1:9000:9000/tcp"]
    volumes: [graylog-data:/usr/share/graylog/data]
volumes:
  mongodb-data:
  datanode-data:
  graylog-data:

Save this as /opt/lrqnet/graylog/docker-compose.yml after reviewing the image versions. The port mapping intentionally exposes Graylog only on localhost; MongoDB and Data Node are not published to the network.

sudo install -m 0600 /dev/null /opt/lrqnet/graylog/.env
sudo sh -c 'printf "%s\n" "GRAYLOG_PASSWORD_SECRET=$1" "GRAYLOG_ROOT_PASSWORD_SHA2=$2" > /opt/lrqnet/graylog/.env' sh "$GRAYLOG_PASSWORD_SECRET" "$GRAYLOG_ROOT_PASSWORD_SHA2"
sudo chmod 0640 /opt/lrqnet/graylog/docker-compose.yml
sudo docker compose --project-directory /opt/lrqnet/graylog config
sudo docker compose --project-directory /opt/lrqnet/graylog up -d

Writes the two generated secrets into a root-readable environment file, verifies the resolved Compose configuration before changing service state, then starts the persistent stack. Clear the two shell variables after this step with unset GRAYLOG_PASSWORD_SECRET GRAYLOG_ROOT_PASSWORD_SHA2.

Native installation on Debian 12 x86_64

Use this route only when the guest exposes AVX. The installer blocks Debian 13, ARM64 and CPUs without AVX instead of using an unsupported MongoDB repository. In Proxmox, review the impact of using CPU type host before changing it, reboot the guest and verify the flag again.

grep -w avx /proc/cpuinfo
curl -fsSL https://scripts.lrq.lat/graylog/v1.0.0/install.sh | sudo bash -s -- install --mode native

Confirms that AVX is visible to the guest, then installs MongoDB 8.0, Graylog Data Node and Graylog Open through their supported Debian 12 repositories.

Complete Graylog preflight

The first Graylog start opens its own preflight workflow. Use the temporary credential emitted by Graylog locally, create or import the Data Node certificate authority, and then sign in with the administrator password chosen during installation. Do not place that temporary credential in tickets, shell history or external logs.

sudo docker compose --project-directory /opt/lrqnet/graylog ps

Shows the Docker service state. For a native deployment, use systemctl status mongod graylog-datanode graylog-server instead.

Validate, back up and maintain

Keep the data volumes and restricted .env file backed up together. Upgrades must be deliberate: review Graylog release notes and compatibility before changing any pinned image or package version.

sudo docker compose --project-directory /opt/lrqnet/graylog ps
sudo docker compose --project-directory /opt/lrqnet/graylog logs --tail=100 graylog datanode

Checks the running containers and shows recent service logs. Review logs locally because first-run output can contain temporary credentials.

sudo docker compose --project-directory /opt/lrqnet/graylog down

Stops the Docker stack without deleting named volumes. Do not add --volumes unless you intentionally want to erase Graylog data.