Graylog 7 runs as three services, and on Ubuntu 26.04 the first one to fail is not Graylog at all. It is MongoDB, which refuses to start on the 7.0 kernel unless you pick the right release line. Get that right and the rest of the install is predictable.
This guide shows how to install Graylog on Ubuntu 26.04, Ubuntu 24.04 and Debian 13 the way the Graylog architecture docs recommend: Graylog server and MongoDB on one host, the Graylog Data Node (managed OpenSearch) on a second, nginx with a Let’s Encrypt certificate in front of the web UI, and a firewall that keeps MongoDB and OpenSearch private. It finishes with a Syslog TCP input, a stream, and a real search over logs shipped from another Linux host. A single server variant is covered too. The lab ran Graylog 7.1.10, MongoDB 8.2.12 and OpenSearch 2.19.5 inside the Data Node on Ubuntu 26.04.1, Ubuntu 24.04.5 and Debian 13 in October 2026.
How the pieces fit
Graylog server receives logs, runs the web UI and API, and keeps its configuration in MongoDB. Messages are stored and searched in the Data Node, which wraps OpenSearch and gets its TLS certificates from Graylog during the first start. Readers only ever reach nginx on 443 and the syslog input on 514:
The Data Node is the hungry part. OpenSearch wants half of the RAM as heap, so keeping it on its own server stops it from starving the Graylog JVM. If you only have one server, follow the same steps on that box and use the changes listed under Install everything on one server.
Prerequisites
Two servers running Ubuntu 26.04, Ubuntu 24.04 or Debian 13, a DNS name for the web UI (an A record pointing at graylog01, with port 80 reachable for the certificate), and sudo access. The table shows what the lab used and what it actually consumed after setup, which is a floor rather than a production target:
| Server | Runs | Lab size | Used after setup | Production starting point |
|---|---|---|---|---|
| graylog01 (192.168.1.247) | Graylog server, MongoDB, nginx | 4 vCPU, 8 GB, 40 GB | 2.4 GB RAM | 8 to 16 GB RAM, SSD for the message journal |
| datanode01 (192.168.1.248) | Graylog Data Node (OpenSearch) | 4 vCPU, 6 GB, 40 GB | 4.9 GB RAM with a 3 GB heap | 16 to 64 GB RAM, disk sized to daily volume times retention days |
| One server (single variant) | All of the above | 4 vCPU, 8 GB, 40 GB | 4.6 to 5.4 GB RAM | 16 GB RAM or more |
Disk is driven by ingest rate and how long you keep messages, so measure a day of real traffic before buying storage. Graylog and the Data Node bundle their own Java runtime. No JDK install is needed. The Graylog support matrix still lists Ubuntu 22.04 and 24.04 and Debian 12; the same packages installed and ran unchanged on Ubuntu 26.04 and Debian 13 in this lab.
These are the ports involved. Everything except 9000 is opened to other machines, but only to the ones that need it:
| Port | Service | Host | Reachable from |
|---|---|---|---|
| 443, 80 | nginx (HTTPS, redirect) | graylog01 | Admins’ browsers |
| 514/tcp | Graylog Syslog TCP input | graylog01 | Servers that send logs |
| 27017/tcp | MongoDB | graylog01 | datanode01 only |
| 9200, 8999/tcp | OpenSearch REST, Data Node API | datanode01 | graylog01 only |
| 9300/tcp | OpenSearch transport (node to node) | datanode01 | Only needed once you add a second Data Node |
| 9000/tcp | Graylog web UI and API | graylog01 | localhost only (nginx) |
Set variables and host names
The same few values repeat across both servers. Run this block on graylog01 and on datanode01, replacing the addresses, the DNS name, the email for Let’s Encrypt and the network your log sources live in. GRAYLOG_IP and DATANODE_IP must be private or LAN addresses, never public ones, because MongoDB and OpenSearch will listen on them:
export GRAYLOG_IP=192.168.1.247
export DATANODE_IP=192.168.1.248
export GRAYLOG_FQDN=graylog.example.com
export ADMIN_EMAIL=[email protected]
export LOG_SOURCES=192.168.1.0/24The Data Node advertises itself by host name (https://datanode01:9200), so graylog01 must be able to resolve datanode01, and datanode01 must resolve graylog01 to reach MongoDB. Use real DNS records if you have them. Otherwise add both names to /etc/hosts on both servers:
echo "${GRAYLOG_IP} graylog01
${DATANODE_IP} datanode01" | sudo tee -a /etc/hostsCloud images that use cloud-init with manage_etc_hosts: true rewrite /etc/hosts on every boot. Our Proxmox clones dropped these lines after the first reboot, and the preflight wizard then failed with the “Unknown host” error shown at the end of this guide. On those images, add the same lines to the cloud-init template as well, or use DNS:
echo "${GRAYLOG_IP} graylog01
${DATANODE_IP} datanode01" | sudo tee -a /etc/cloud/templates/hosts.debian.tmplTemplates on other distributions follow the same pattern (hosts.<distro>.tmpl).
Graylog stores timestamps in UTC, so set the system clock to match on both servers and install the tools the repositories need:
sudo timedatectl set-timezone UTC
sudo apt update
sudo apt install -y gnupg curl wgetInstall MongoDB on graylog01
Use the MongoDB 8.2 line. The 8.0 packages refuse to start on any kernel at or above 6.19, which includes the 7.0 kernel in Ubuntu 26.04, and the fix had not reached the 8.0 repository at the time of testing. Graylog 7.1 supports MongoDB 7.0 through 8.2, so 8.2 is the release that works on all three distributions with one set of commands. MongoDB also publishes no server packages for the 26.04 or Debian 13 code names yet, so the repositories below point at 24.04 (noble) and Debian 12 (bookworm) builds, which run unchanged on the newer releases.
Import the signing key. The 8.2 repository is signed with the 8.0 key, hence the 8.0 in the file name:
curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmorOn Ubuntu 26.04 and 24.04, add the noble repository:
echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.2 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.2.list #https://www.mongodb.com/docs/manual/release-notes/On Debian 13, add the bookworm repository instead:
echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/8.2 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.2.list #https://www.mongodb.com/docs/manual/release-notes/Install MongoDB and hold the package so a routine apt upgrade never moves it to a release Graylog does not support:
sudo apt update
sudo apt install -y mongodb-org
sudo apt-mark hold mongodb-orgMongoDB listens on 127.0.0.1 by default and has no authentication. The Data Node on the other server needs to reach it, so it will listen on the LAN address too. Turn the firewall on first, so that port 27017 is never open to anyone but datanode01. Ports 80 and 443 are opened now too, because the Let’s Encrypt step later needs port 80. They are plain port rules because the “Nginx Full” UFW profile only exists once nginx is installed; before that, ufw allow "Nginx Full" fails with ERROR: Could not find a profile matching 'Nginx Full'. UFW ships with Ubuntu; on Debian 13 install it with sudo apt install -y ufw. Allow SSH before enabling, or you lock yourself out of the server you are typing on (allow your own port too if sshd does not use 22):
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow from ${DATANODE_IP} to any port 27017 proto tcp
sudo ufw --force enableNow add the graylog01 address to bindIp and start MongoDB:
sudo sed -i "s/^ bindIp: 127.0.0.1$/ bindIp: 127.0.0.1,${GRAYLOG_IP}/" /etc/mongod.conf
sudo systemctl daemon-reload
sudo systemctl enable --now mongodCheck the version and the two listeners:
mongod --version | head -1
sudo ss -tlnp | grep 27017MongoDB answers on loopback and on the LAN address:
db version v8.2.12
LISTEN 0 4096 192.168.1.247:27017 0.0.0.0:* users:(("mongod",pid=892,fd=10))
LISTEN 0 4096 127.0.0.1:27017 0.0.0.0:* users:(("mongod",pid=892,fd=9))Install the Graylog Data Node on datanode01
Graylog ships one repository package per release line. It adds the apt source and signing key for both the Data Node and the server:
wget https://packages.graylog2.org/repo/packages/graylog-7.1-repository_latest.deb #https://graylog.org/releases/
sudo dpkg -i graylog-7.1-repository_latest.deb
sudo apt update
sudo apt install -y graylog-datanodeOpenSearch needs vm.max_map_count of at least 262144. Check it before following any guide that tells you to set it:
cat /proc/sys/vm/max_map_countUbuntu 26.04, Ubuntu 24.04 and Debian 13 all ship with a higher value already:
1048576Leave it alone. Writing vm.max_map_count=262144 into /etc/sysctl.d/, as the Graylog docs suggest, lowers the limit on these releases because the new file is read last. Only set it on a system that reports less than 262144.
Now generate the password_secret. Graylog and the Data Node use it to sign and encrypt data, and both must carry the identical value. Generate it once here and keep the output for graylog01:
export GRAYLOG_SECRET=$(openssl rand -hex 48)
echo "$GRAYLOG_SECRET"Write the secret and the MongoDB address into /etc/graylog/datanode/datanode.conf, then add the OpenSearch heap. Graylog recommends half of the RAM, up to 31 GB; datanode01 has 6 GB, so 3 GB:
sudo sed -i "s|^password_secret =.*|password_secret = ${GRAYLOG_SECRET}|; s|^mongodb_uri =.*|mongodb_uri = mongodb://graylog01:27017/graylog|" /etc/graylog/datanode/datanode.conf
echo "opensearch_heap = 3g" | sudo tee -a /etc/graylog/datanode/datanode.confConfirm the MongoDB line and start the service:
sudo grep -E "^(mongodb_uri|opensearch_heap)" /etc/graylog/datanode/datanode.conf
sudo systemctl daemon-reload
sudo systemctl enable --now graylog-datanodeWithin a few seconds the Data Node logs that its management API is up on 8999. OpenSearch itself stays down until the preflight wizard issues its certificate:
sudo tail -5 /var/log/graylog-datanode/datanode.logThe last lines confirm the REST listener:
2026-10-07T16:38:11.729Z INFO [DatanodeBootstrap] Graylog DataNode datanode up and running.
2026-10-07T16:38:12.355Z INFO [Version] HV000001: Hibernate Validator 9.1.0.Final
2026-10-07T16:38:12.636Z INFO [NetworkListener] Started listener bound to [0.0.0.0:8999]
2026-10-07T16:38:12.638Z INFO [HttpServer] [HttpServer] Started.
2026-10-07T16:38:12.639Z INFO [JerseyService] Started REST API at <0.0.0.0:8999>Install the Graylog server on graylog01
Add the same repository package and install the server:
wget https://packages.graylog2.org/repo/packages/graylog-7.1-repository_latest.deb #https://graylog.org/releases/
sudo dpkg -i graylog-7.1-repository_latest.deb
sudo apt update
sudo apt install -y graylog-serverPaste the secret you generated on datanode01 into the variable, replacing the placeholder:
export GRAYLOG_SECRET='paste-the-secret-from-datanode01'Choose the password for the admin account. Graylog only stores its SHA-256 hash, and read -s keeps the plain text out of your shell history:
read -rsp "Graylog admin password: " GL_PASS; echo
export ADMIN_SHA2=$(echo -n "$GL_PASS" | sha256sum | cut -d" " -f1)
unset GL_PASSPut both values into /etc/graylog/server/server.conf and tell Graylog the public HTTPS address it will be reached on. The web listener stays on its default of 127.0.0.1:9000, which is exactly what nginx needs, so it is not touched:
sudo sed -i "s|^password_secret =.*|password_secret = ${GRAYLOG_SECRET}|; s|^root_password_sha2 =.*|root_password_sha2 = ${ADMIN_SHA2}|; s|^#http_external_uri =.*|http_external_uri = https://${GRAYLOG_FQDN}/|" /etc/graylog/server/server.confThe package sets a 1 GB heap. On an 8 GB server shared with MongoDB, 2 GB is a sensible start:
sudo sed -i 's/-Xms1g -Xmx1g/-Xms2g -Xmx2g/' /etc/default/graylog-server
sudo systemctl daemon-reload
sudo systemctl enable --now graylog-serverOn first start Graylog enters preflight mode with a one-time password, because it has no Data Node certificates yet. Read it from the log:
sudo grep -A1 "Initial configuration is accessible" /var/log/graylog-server/server.logNote the password. You need it once, for the wizard:
Initial configuration is accessible at 127.0.0.1:9000, with username 'admin' and password 'qhyzBdPsyh'.
Try clicking on http://admin:[email protected]:9000Put nginx and Let’s Encrypt in front
Graylog listens only on loopback, so nothing reaches it until nginx proxies it. Install nginx on graylog01 and remove the default site:
sudo apt install -y nginx certbot python3-certbot-nginx
sudo rm -f /etc/nginx/sites-enabled/defaultCreate the virtual host:
sudo vim /etc/nginx/sites-available/graylog.confAdd the following, with your own DNS name on the server_name line:
server {
listen 80;
server_name graylog.example.com;
location / {
proxy_pass http://127.0.0.1:9000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
}
}Enable it and test the syntax:
sudo ln -s /etc/nginx/sites-available/graylog.conf /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginxRequest the certificate with the HTTP-01 challenge. This works with any DNS provider as long as the A record points at graylog01 and port 80 is reachable from the internet. --redirect makes certbot add the HTTP to HTTPS redirect:
sudo certbot --nginx -d "${GRAYLOG_FQDN}" --non-interactive --agree-tos --redirect -m "${ADMIN_EMAIL}"Certbot rewrites the virtual host with a 443 listener and the certificate paths:
Requesting a certificate for graylog.example.com
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/graylog.example.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/graylog.example.com/privkey.pem
Deploying certificate
Successfully deployed certificate for graylog.example.com to /etc/nginx/sites-enabled/graylog.conf
Congratulations! You have successfully enabled HTTPS on https://graylog.example.comOur lab servers have no public address, so the certbot run above was pointed at a local test ACME server (Pebble) with --server. The nginx changes, the redirect and the renewal timer are exactly what certbot produces against Let’s Encrypt; only the issuing CA differs. Confirm renewal works:
sudo certbot renew --dry-runThe dry run ends with a success line for the Graylog certificate:
Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/graylog.example.com/fullchain.pem (success)Alternative: DNS-01 for a server with no public port 80
A Graylog server on a private LAN cannot answer the HTTP-01 challenge. Prove ownership through a DNS TXT record instead, using the certbot plugin for your DNS provider:
| DNS provider | Package | Certbot flag |
|---|---|---|
| Cloudflare | python3-certbot-dns-cloudflare | –dns-cloudflare |
| Amazon Route 53 | python3-certbot-dns-route53 | –dns-route53 |
| DigitalOcean | python3-certbot-dns-digitalocean | –dns-digitalocean |
| Google Cloud DNS | python3-certbot-dns-google | –dns-google |
| BIND or any RFC 2136 server | python3-certbot-dns-rfc2136 | –dns-rfc2136 |
The Cloudflare example below needs an API token with Zone DNS Edit permission. Substitute the plugin and credentials file for your provider if you use something else. Store the token in a root-only file:
sudo apt install -y python3-certbot-dns-cloudflare
echo "dns_cloudflare_api_token = your-cloudflare-token" | sudo tee /etc/letsencrypt/cloudflare.ini
sudo chmod 600 /etc/letsencrypt/cloudflare.iniIssue the certificate, then hand it to the nginx installer so it adds the 443 block and the redirect. The deploy hook reloads nginx after every renewal, which certonly does not do on its own. Our lab used the HTTP-01 flow above, so this path was not run end to end here:
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini -d "${GRAYLOG_FQDN}" --non-interactive --agree-tos -m "${ADMIN_EMAIL}" --deploy-hook "systemctl reload nginx"
sudo certbot install --nginx --cert-name "${GRAYLOG_FQDN}" --redirectOpen the firewall
UFW is already active on graylog01 from the MongoDB step, with SSH, HTTP/HTTPS and MongoDB for datanode01. Add the syslog input for your log sources:
sudo ufw allow from ${LOG_SOURCES} to any port 514 proto tcp
sudo ufw statusOn datanode01, OpenSearch and the Data Node API answer graylog01 and nothing else. On Debian 13 run sudo apt install -y ufw first. SSH is allowed before the firewall is enabled:
sudo ufw allow OpenSSH
sudo ufw allow from ${GRAYLOG_IP} to any port 8999,9200 proto tcp
sudo ufw --force enableFrom a third machine on the LAN the boundary is easy to prove (the names must resolve there too, or use the IP addresses). The syslog port connects, MongoDB and OpenSearch time out:
nc -zv -w3 graylog01 514
nc -zv -w3 graylog01 27017
nc -zv -w3 datanode01 9200Output from client01 in our lab:
Connection to graylog01 (192.168.1.247) 514 port [tcp/shell] succeeded!
nc: connect to graylog01 (192.168.1.247) port 27017 (tcp) timed out: Operation now in progress
nc: connect to datanode01 (192.168.1.248) port 9200 (tcp) timed out: Operation now in progressFinish the preflight wizard
Open https://graylog.example.com and sign in as admin with the temporary password from the log, not your own. The page lists every Data Node that has registered in MongoDB. If datanode01 is missing here, the Data Node cannot reach MongoDB on 27017; check its log before going further.
The checklist on the left tracks four stages; the buttons on the right drive them. Create CA builds an internal certificate authority that only signs Data Node certificates. Create policy keeps the default: automatic renewal with a 30 day certificate lifetime. Provision certificate and continue issues datanode01 its certificate and starts OpenSearch. When the node badge turns green and shows https://datanode01:9200, every step is ticked:
Click Resume startup. Graylog restarts in normal mode and the login page appears. From now on sign in as admin with the password you hashed into root_password_sha2. The temporary one stops working.
Send logs from a Linux host
An empty Graylog proves nothing, so add an input and point a server at it. Go to System > Inputs, pick Syslog TCP in the drop-down and click Launch new input. Give it a title, keep bind address 0.0.0.0 and leave the port at 514.
Older guides move syslog inputs to 1514 because ports under 1024 need root. That no longer applies: the graylog-server systemd unit grants CAP_NET_BIND_SERVICE, and our input bound to 514 as the graylog user on the first try. Keeping 514 means every client can use the standard syslog port.
Graylog 7.1 then opens an Input Setup Wizard. Choose Create Stream, name it, and tick Remove matches from ‘Default Stream’ so these messages are not stored twice. The wizard warns about the Default index set; that is fine for a first input, and a dedicated index set per log type is worth adding once you have more than one source.
Click Next, then Start Input. The wizard creates the stream, a pipeline and the routing rule, then starts the input:
On the server you want to collect from (client01 here, an Ubuntu 26.04 box), rsyslog is already installed. Debian 13 logs to the journal only, so run sudo apt install -y rsyslog there first. Make sure it can resolve graylog01 through DNS or /etc/hosts, then create a forwarding rule:
sudo vim /etc/rsyslog.d/60-graylog.confThis sends every message over TCP in RFC 5424 format. Giving the queue a file name makes it disk-assisted, so messages wait in memory (and spill to disk when memory fills) while Graylog is down, and unsent ones survive an rsyslog restart:
# Forward everything to Graylog over TCP, RFC 5424 format, with a disk-assisted queue
*.* action(type="omfwd" target="graylog01" port="514" protocol="tcp"
template="RSYSLOG_SyslogProtocol23Format"
queue.type="LinkedList" queue.filename="graylog_fwd"
queue.saveOnShutdown="on" action.resumeRetryCount="-1")Validate the configuration, restart rsyslog and send a test line:
sudo rsyslogd -N1
sudo systemctl restart rsyslog
logger -t cfg-test "Hello Graylog from $(hostname)"
sudo ss -tn | grep ":514"The validation run is clean and the TCP session to the input stays established:
rsyslogd: version 8.2512.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.
ESTAB 0 0 192.168.1.249:59276 192.168.1.247:514Back in System > Inputs, the input shows as running with traffic:
To get something worth finding, we tried SSH logins to client01 with three accounts that do not exist. Searching for source:client01 AND "Invalid user" over the last hour returns each attempt:
The Graylog web interface tour covers saved searches, dashboards and alerts from here. For a plain rsyslog collector without Graylog, see the centralized rsyslog server guide.
Verify the Graylog stack
Three commands on graylog01 tell you whether everything is healthy:
systemctl is-active mongod graylog-server nginx
curl -s http://127.0.0.1:9000/api/system/lbstatus; echo
curl -s -u admin http://127.0.0.1:9000/api/system/indexer/cluster/health; echoThe last command prompts for the admin password. All services are active, the load balancer check says ALIVE, and the search cluster reports its shards:
active
active
active
ALIVE
{"status":"yellow","shards":{"active":9,"initializing":0,"relocating":0,"unassigned":1}}A single Data Node may report yellow, and it does not affect your messages. The Graylog index sets use zero replicas. The one unassigned shard is the replica of the OpenSearch system index .opendistro-job-scheduler-lock, which has no second node to live on. On our three lab stacks health flipped between green and yellow during the session; we did not pin down why. Do not try to set its replicas to 0 through the Graylog API: the Data Node proxy refuses the request with “This request is not allowed”.
Check the listeners on both servers. On graylog01, port 9000 must be on loopback only:
sudo ss -tlnp | grep -E ':(80|443|514|9000|27017) ' | awk '{print $1, $4}'Our graylog01 listeners:
LISTEN 0.0.0.0:443
LISTEN 0.0.0.0:80
LISTEN 192.168.1.247:27017
LISTEN 127.0.0.1:27017
LISTEN *:514
LISTEN [::ffff:127.0.0.1]:9000On datanode01 the same check covers OpenSearch and the management API:
sudo ss -tlnp | grep -E ':(8999|9200|9300) ' | awk '{print $1, $4}'All three listen on every interface. The firewall rules are what keep them private:
LISTEN *:9300
LISTEN *:9200
LISTEN *:8999Install everything on one server
We ran the full stack on single 8 GB servers with Ubuntu 24.04 and Debian 13. Follow the same sections in order on one machine, with these differences:
- Skip the
/etc/hostsstep, the MongoDBbindIpchange and the 27017 firewall rule. MongoDB stays on 127.0.0.1. - Leave
mongodb_uriindatanode.confat its default ofmongodb://localhost/graylog, and only replacepassword_secret. - Split the RAM:
opensearch_heap = 2gand a 2 GB Graylog heap on an 8 GB box. - In the firewall, open only SSH, 80/tcp, 443/tcp and 514/tcp from your log sources. Nothing else needs to be reachable.
After the preflight wizard both single servers reported all three services active and about 2.5 to 3.3 GB of RAM still available. The table lists everything that differs between the distributions:
| Item | Ubuntu 26.04 | Ubuntu 24.04 | Debian 13 |
|---|---|---|---|
| MongoDB repository | ubuntu noble 8.2 | ubuntu noble 8.2 | debian bookworm 8.2 |
| MongoDB 8.0 line | Refuses to start (kernel 7.0) | Only on the 6.8 GA kernel; refuses on the 7.0 HWE kernel | Only on kernels older than 6.19 |
| Default vm.max_map_count | 1048576 | 1048576 | 1048576 |
| UFW | Installed | Installed | apt install ufw |
| Graylog packages and paths | Identical: graylog-7.1 repository, /etc/graylog/server and /etc/graylog/datanode | ||
For a container-based install of the same stack, see Graylog 7 with Docker Compose; for the RHEL family, Graylog on Rocky Linux and AlmaLinux. The Graylog Ubuntu installation docs and compatibility matrix are the references this lab was checked against.
Errors from the lab and how we fixed them
“MongoDB cannot start: Linux kernel versions 6.19 and newer has a known incompatibility”
This is MongoDB 8.0 on Ubuntu 26.04. The service exits within a second, and the journal shows the reason:
{"t":{"$date":"2026-10-07T16:32:49.289Z"},"s":"F", "c":"CONTROL", "id":12257600,"ctx":"main","msg":"MongoDB cannot start: Linux kernel versions 6.19 and newer has a known incompatibility with this version of MongoDB. See https://jira.mongodb.org/browse/SERVER-121912 for more information."}We saw it with 8.0.32 on both the 26.04 release kernel and the current 7.0.0-38 update. The bug sits in the TCMalloc library bundled with MongoDB, and MongoDB added this check so the server stops instead of crashing later. MongoDB 8.0.35 recognises patched Ubuntu kernels and lets them start. Until that is in the repository, purge the 8.0 packages and install from the 8.2 repository as shown above. MongoDB 8.2.12 kept running on the same kernel for the rest of the lab session.
“Unable to retrieve version from indexer node: Unknown host ‘datanode01′”
The preflight wizard sat on “Provisioning certificate…” and printed this under the node, and /var/log/graylog-server/server.log repeated it every three seconds. The Data Node registers itself by host name, and graylog01 could not resolve it because cloud-init had rewritten /etc/hosts during a reboot. Add the host names back (or create DNS records). The wizard picks them up on its next poll without a restart:
getent hosts datanode01It must print the Data Node address before provisioning can finish.
“E: Unable to locate package graylog-server”
Graylog is not in the Ubuntu or Debian archives. This error means the graylog-7.1-repository package was not installed on that server, or sudo apt update was not run after dpkg -i. Each server needs the repository package, because graylog01 and datanode01 install different packages from it.
vm.max_map_count drops after following the docs
No error appears, but the limit is lower than before. Ubuntu 26.04, Ubuntu 24.04 and Debian 13 ship vm.max_map_count = 1048576 in /usr/lib/sysctl.d or /etc/sysctl.d. A new 99-graylog-datanode.conf with 262144 is applied last and wins. If you already created it, remove it and reload:
sudo rm /etc/sysctl.d/99-graylog-datanode.conf
sudo sysctl --system
cat /proc/sys/vm/max_map_countThe value returns to 1048576, which already meets the Data Node requirement.
thanks a lot
it work in a LXC container