Setup Graylog on Synology DSM 7.x with Docker for UniFi logs
Tags: graylog, docker, synology, unifi
Published: 2023-01-20 16:20:14

---
title: Setup Graylog on Synology DSM 7.x with Docker for UniFi logs
published: true
description: How to setup Graylog on DSM 7.x using Docker and Docker Compose as a log ingestion and observabilityu. My end goal was to have a decent platform to host UniFi device logs for troubleshooting in case I need to look up some info.
tags: graylog, docker, synology, unifi
cover_image: https://user-images.githubusercontent.com/1192590/213726531-891cb49b-520a-4086-a85f-d24a6db779b6.png
# Use a ratio of 100:42 for best results.
# published_at: 2023-01-19 21:11 +0000
---

![graylog-ui](https://user-images.githubusercontent.com/1192590/213715379-523cc084-3e63-46a0-bbeb-37bd0b8659f6.jpg)


> _If you're just looking for a functional `docker.compose.yml` that works on Synology DSM 7, you can find it [here](#working-docker-file)._

I recently encountered some issues with my UniFi devices and attempted to review the logs for troubleshooting. However, I found that the UniFi OS lacks efficient log management capabilities. With this in mind, I recalled that [Lawrence Systems]((https://www.youtube.com/@LAWRENCESYSTEMS)) utilizes [Graylog for indexing and reading UniFi logs](https://www.youtube.com/watch?v=rtfj6W5X0YA), so I set out to do the same myself.

I run most of my shared services on my Synology NAS that's running DSM 7. To ensure reliability and ease of restoration in case of a data loss, I have invested time in running all my services via `docker-compose` and regularly backup all my service configurations. While adding Graylog to my setup through this method should have been relatively simple, the particular context of DSM and my specific NAS created some complications.

So how hard can it be to just add a few more lines to the `docker-compose.yml` file and spin up Graylog for all my log ingestion needs? Not hard, but troublesome in the particular context of DSM and your particular NAS...

# Setup Overview

This is my target setup:
  - Run Graylog's most recent version as a shared service in my NAS
  - Use `docker` and `docker-compose` to define all required services
  - Forward logs from my UniFi controller to Graylog
  - Consume those logs via any internal client in my network
 
![graylog-nas-docker-dsm7-setup-diagram](https://user-images.githubusercontent.com/1192590/213481372-5dcf3adb-964d-4bf1-850c-13e9ed04c470.jpg)

# Issues running vanilla configuration on DSM 7

When I was looking for official docs on the matter I found two links which give you slightly different instructions:
 - [Official docs](https://go2docs.graylog.org/5-0/downloading_and_installing_graylog/docker_installation.htm#example-version-3)
 - [Official GitHub repo](https://github.com/Graylog2/docker-compose/blob/main/open-core/docker-compose.yml)

They differ in some aspects, but ultimately, as I tried to run and fix the provided `docker-compose.yml` for DSM 7, I started encountering some issues :point_down:.

## MongoDB 5 requires AVX Support on the NAS CPU

```WARNING: MongoDB 5.0+ requires a CPU with AVX support, and your current system does not appear to have that!```

So what exactly is AVX? 🤔

> _Advanced Vector Extensions (AVX) are extensions to the x86 instruction set architecture for microprocessors from Intel and Advanced Micro Devices (AMD). They were proposed by Intel in March 2008 and first supported by Intel with the Sandy Bridge[1] processor shipping in Q1 2011 and later by AMD with the Bulldozer[2] processor shipping in Q3 2011. AVX provides new features, new instructions and a new coding scheme. - [Wikipedia](https://en.wikipedia.org/wiki/Advanced_Vector_Extensions)_

It [seems](https://www.reddit.com/r/synology/comments/t88cs7/avx_support/hzoivno/) this is not a thing in Celeron CPUs and as such support on Synology NAS will be reduced, especially for the home and semi-pro variants of their products. 

**✅ Solution:** Downgrade MongoDB to latest 4.x which doesn't require AVX support.

## Graylog 5 requires MongoDB 5

```org.graylog2.bootstrap.preflight.PreflightCheckException: You're running MongoDB 4.4.18 but Graylog requires at least MongoDB 5.0.0. Please upgrade.```

As an end-user who primarily wants to ingest logs into Graylog and be able to query them, I was not overly concerned with this downgrade.

**✅ Solution:** Downgrade Graylog to latest 4.x which doesn't require MongoDB 5.x

## Incorrect mapping of elasticsearch folder

This is the issue that really got me. When playing with `docker` every time I have path access issues it's either the user I'm defining lacking permissions of the local folder I'm mapping simply doesn't exist. While troubleshooting this, I went nuts trying to find why docker didn't have access to the folder in question, to the point I gave up. After a day or so I picked up this project again, and then I found a Stackoverflow post suggesting to change the path on the docker image itself:

[![stackoverflow-post](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rwz38bke5wa3slp3iwpm.jpg)](https://stackoverflow.com/a/71487266/1174076)

**Solution ✅ :** Change the `elasticsearch` internal path from `/usr/share/elasticsearch/data` to `/var/lib/elasticsearch/data`

## Graylog not able to write files in the mapped volume

Unfortunately, this is an issue for which I do not have a solution on DSM. As it stands, `graylog` doesn't use the `root` user in the container, so it creates a `user:group` `1100:1100`. I've read plenty of solutions to just `chown` the folder to that `user:group` but this didn't solve it.

I then tried to create a group and user on DSM with `addgroup`, but then I found **that DSM does not allow you to create users and groups with specific ids**. I went to the trouble of trying to create some of the files that graylog was trying to generate like the `graylog.conf`, but as I was doing that I've figured this will be a non-ending problem.

{% github https://github.com/Graylog2/graylog2-server/issues/2155 %}

# Working docker file  

As it is, I've failed to setup a persistent configuration for graylog on DSM. If anyone has solved this please let me know in the comments. The docker file you see below will use volatile storage, so you'll loose your logs and configurations upon a single container stop.

{% gist https://gist.github.com/bitoiu/3498a6bc050891aeb151b4f2ace9b5d0 %}

# Setting up a new input on Graylog

After Graylog is running, and you login via `http://hostname:9000`, you'll be alerted there are no inputs set. Navigate to `System -> Inputs`:

![system-inputs-menu](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vz0itnuyzx0071349ok0.jpg)

On the Inputs screen, find the dropdown with `Select Input` and pick `Syslog UDP`:

![syslog-udp-input](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o2r6iieup7s1ivw45vq4.jpg)

Give it whatever name you'd like. The input is pretty much ready to go, with the exception of the default port. Change it from `514` to `1514`:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zgijcj99x8jtmhrw2w2y.jpg)

This is it on the Graylog side, lets go to the Unifi controller to forward the logs.

# Setting up log forwarding on UniFi controller

When I say UniFi controller, I mean any of their controller products: CloudKey, UniFi Dream Router or UniFi Dream Machine. I'm personally a CloudKey user.

Go into `Network -> Settings` and expand support, until you see this block. Tick the `Syslog` checkbox, and fill in your NAS hostname, as well as the port `1514`

![unifi-log-fw](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2hvl9ewdiotfqwjn62hw.jpg)

# Checking our logs on Graylog

If everything was configured properly you should see your UniFi logs on graylog. If you have any comments and improvements for the post, I'm always looking for advice and guidance :bow:

![graylog-ui](https://user-images.githubusercontent.com/1192590/213715379-523cc084-3e63-46a0-bbeb-37bd0b8659f6.jpg)