LogScale on Bare Metal - Installing LogScale

We recommend installing LogScale on Ubuntu using a LTS release. Before completing the LogScale installation, the following must be in place:

There are some additional preparations required before installing LogScale.

LogScale User & Directories

A suitable user and directories to store the LogScale data must be created first:

  1. Create a non-administrative user named humio to run LogScale software in the background:

    shell
    $ adduser humio --shell=/bin/false --no-create-home --system --group

    A add this user to the DenyUsers section of the /etc/ssh/sshd_config file on each node to prevent it from being able to ssh or sftp into the node. Restart the sshd daemon after making the change.

  2. Create the LogScale system directories and give the humio user ownership of them:

    shell
    $ mkdir -p /opt/humio /etc/humio/filebeat /var/log/humio /var/humio/data
$ chown humio:humio /opt/humio /etc/humio/filebeat
$ chown humio:humio /var/log/humio /var/humio/data

LogScale Software Installation

The LogScale software is distributed as a tarball. This should be downloaded into the LogScale users home directory, and then extracted before configuration:

shell
$ cd /opt/humio/
$ wget https://repo.humio.com/repository/maven-releases/com/humio/server/1.112.0/server-1.112.0.tar.gz
$ tar xzf /opt/humio/server-1.112.0.tar.gz

The wget here is used to download the latest release from https://repo.humio.com/service/rest/repository/browse/maven-releases/com/humio/server/.

LogScale Configuration

The LogScale configuration is stored in a file server.conf in the /etc/humio directory. The lines in this file contain configuration information as key/value pairs that are referred to as the LogScale environment variables

Below is a sample configuration file that defines a LogScale configuration for a single host:

ini
AUTHENTICATION_METHOD=single-user
DIRECTORY=/var/humio/data
HUMIO_AUDITLOG_DIR=/var/log/humio
HUMIO_DEBUGLOG_DIR=/var/log/humio
JVM_LOG_DIR=/var/log/humio
HUMIO_PORT=8080
ELASTIC_PORT=9200
ZOOKEEPER_URL=kafka1:2181,kafka2:2181,kafka3:2181
KAFKA_SERVERS=kafka1:9092,kafka2:9092,kafka3:9092
EXTERNAL_URL=http://127.0.0.1:8080
PUBLIC_URL=http://127.0.0.1

These lines configure the following settings:

Important

Changes made to the configuration files must be made on all nodes, and each node will need to be restarted for the changes to take effect.

For more information on each of the environment variables, see LogScale Configuration Parameters.

Configuring LogScale as a Service

Next you should set up a service file. Using a simple text editor, create a file named, humio.service in the /etc/systemd/system/ sub-directory. Add these lines to that file:

ini
[Unit]
Description=LogScale service
After=network.service

[Service]
Type=notify
Restart=on-abnormal
User=humio
Group=humio
LimitNOFILE=250000:250000
EnvironmentFile=/etc/humio/server.conf
WorkingDirectory=/var/humio
ExecStart=/opt/humio/humio/bin/humio-server-start.sh
TimeoutSec=900

[Install]
WantedBy=default.target

Configuring the service uses the LogScale Launcher Script

LogScale Ownership & Start-up

The ownership of the LogScale files and start the LogScale service must be changed to the humio user created earlier:

shell
$ chown -R humio:humio /opt/humio /etc/humio/filebeat
$ chown -R humio:humio /var/log/humio /var/humio/data

LogScale is now ready to be started using the systemctl utility:

shell
$ systemctl start humio

Check that LogScale is running using the journalctl tool:

shell
$ journalctl -fu humio

If there are no errors, open a web browser and enter the domain name or IP address with port 8080.