LogScale on Bare Metal - Installing LogScale

We recommend installing LogScale on Ubuntu using a LTS release. Before completing the LogScale installation, the following must be in place:

There are some additional preparations required before installing LogScale.

LogScale User & Directories

A suitable user and directories to store the LogScale data must be created first:

  1. Create a non-administrative user named humio to run LogScale software in the background:

    shell
    $ adduser humio --shell=/bin/false --no-create-home --system --group

    A add this user to the DenyUsers section of the /etc/ssh/sshd_config file on each node to prevent it from being able to ssh or sftp into the node. Restart the sshd daemon after making the change.

  2. Create the LogScale system directories and give the humio user ownership of them:

    shell
    $ mkdir -p /opt/humio /etc/humio/filebeat /var/log/humio /var/humio/data
$ chown humio:humio /opt/humio /etc/humio/filebeat
$ chown humio:humio /var/log/humio /var/humio/data

LogScale Software Installation

The LogScale software is distributed as a tarball. This should be downloaded into the LogScale users home directory, and then extracted before configuration:

For glibc Linux distributions

shell
$ cd /opt/humio/
$ wget https://repo.humio.com/repository/maven-releases/com/humio/server/1.156/server-linux_x64-1.156.tar.gz
$ tar xzf /opt/humio/server-linux_x64-1.156.tar.gz

For musl libc Linux distributions

shell
$ cd /opt/humio/
$ wget https://repo.humio.com/repository/maven-releases/com/humio/server/1.156/server-alpine_x64-1.156.tar.gz
$ tar xzf /opt/humio/server-alpine_x64-1.156.tar.gz

The wget here is used to download the latest release from https://repo.humio.com/service/rest/repository/browse/maven-releases/com/humio/server/.

LogScale Configuration

The LogScale configuration is stored in a file server.conf in the /etc/humio directory. The lines in this file contain configuration information as key/value pairs that are referred to as the LogScale environment variables

Below is a sample configuration file that defines a LogScale configuration for a single host:

Kafka in Kraft Mode
ini
AUTHENTICATION_METHOD=single-user
DIRECTORY=/var/humio/data
HUMIO_AUDITLOG_DIR=/var/log/humio
HUMIO_DEBUGLOG_DIR=/var/log/humio
JVM_LOG_DIR=/var/log/humio
HUMIO_PORT=8080
ELASTIC_PORT=9200
KAFKA_SERVERS=kafka1:9092,kafka2:9092,kafka3:9092
KAFKA_BOOTSTRAP_SERVERS=kafka1:9092,kafka2:9092,kafka3:9092
EXTERNAL_URL=http://127.0.0.1:8080
PUBLIC_URL=http://127.0.0.1

These lines configure the following settings:

  • AUTHENTICATION_METHOD=single-user

    Sets the authentication method. Initially a single-user model is used. The SINGLE_USER_USERNAME and SINGLE_USER_PASSWORD can be added to set a username and password to connect to the cluster. For information on other authorization methods, see Authentication & Identity Providers.

  • DIRECTORY=/var/humio/data

    Sets the directory where LogScale will store data.

  • HUMIO_AUDITLOG_DIR=/var/log/humio

    Sets the directory for logs from LogScale for auditing.

  • HUMIO_DEBUGLOG_DIR=/var/log/humio

    Sets the directory for logs from LogScale.

  • JVM_LOG_DIR=/var/log/humio

    Sets the directory for logs from LogScale.

  • HUMIO_PORT=8080

    Sets the default port that will be used to access LogScale.

  • ELASTIC_PORT=9200

    Sets the port for ingesting data using the Elastic bulk protocol.

  • KAFKA_SERVERS=kafka1:9092,kafka2:9092,kafka3:9092

    Sets the list of Kafka servers required by LogScale.

  • KAFKA_BOOTSTRAP_SERVERS=kafka1:9092,kafka2:9092,kafka3:9092

    If using Kafka in Kraft mode, set the bootstrap servers to configure the location for configuration LogScale and Kafka started.

  • EXTERNAL_URL=http://127.0.0.1:8080

    Sets the external URL that LogScale will listen for connections. The above uses the localhost address (127.0.0.1) but this should be changed to the hostname of the LogScale node, for example logscale1.

  • PUBLIC_URL=http://127.0.0.1

    Sets the public URL that LogScale will use to advertise and create links. The above uses the localhost address (127.0.0.1), but this should be changed to the IP address of the load balance used to access the cluster. See Installing Load Balancers for more information.

Important

Changes made to the configuration files must be made on all nodes, and each node will need to be restarted for the changes to take effect.

For more information on each of the environment variables, see LogScale Configuration Parameters.

Configuring LogScale as a Service

Next you should set up a service file. Using a simple text editor, create a file named, humio.service in the /etc/systemd/system/ sub-directory. Add these lines to that file:

ini
[Unit]
Description=LogScale service
After=network.service

[Service]
Type=notify
Restart=on-abnormal
User=humio
Group=humio
LimitNOFILE=250000:250000
EnvironmentFile=/etc/humio/server.conf
WorkingDirectory=/var/humio
ExecStart=/opt/humio/humio/bin/humio-server-start.sh
TimeoutSec=900

[Install]
WantedBy=default.target

Configuring the service uses the LogScale Launcher Script

LogScale Ownership & Start-up

The ownership of the LogScale files and start the LogScale service must be changed to the humio user created earlier:

shell
$ chown -R humio:humio /opt/humio /etc/humio/filebeat
$ chown -R humio:humio /var/log/humio /var/humio/data

LogScale is now ready to be started using the systemctl utility:

shell
$ systemctl start humio

Check that LogScale is running using the journalctl tool:

shell
$ journalctl -fu humio

If there are no errors, open a web browser and enter the domain name or IP address with port 8080.