As a part of Azure SIEM Setup, I'm currently setting up Kibana VM on an Ubuntu 20.04 server as part of my ELK stack for monitoring. However, despite the Kibana service running successfully, I am unable to access the Kibana web interface.
Here are the details of my setup:
Kibana Version: I initially had Kibana version 7.17.24, but I downgraded it to version 7.6.1 to match my Elasticsearch version.
Elasticsearch Version: 7.6.1
Operating System: Ubuntu 20.04
Service Status: I confirmed that Kibana is running
sudo systemctl status kibana
The output indicates that the service is active and running.
Listening on Port:
Kibana is configured to listen on port 5601, and I verified this with:
sudo ss -tuln | grep 5601
tcp LISTEN 0 511 0.0.0.0:5601 0.0.0.0:*
Connectivity Tests:
When I try to access Kibana from the same server using:
curl -X GET "http://localhost:5601"
I get no response.
Additionally, I attempted to access Kibana from another machine on the same network using:
curl -X GET "http://serverIp:5601"
This also results in no response, with a connection timeout error.
Network Configuration:
My server’s IP address is 10.0.x.x. The firewall (UFW) is currently inactive:
sudo ufw status
Status: inactive
Log Files:
I checked the Kibana log file located at /var/log/kibana/kibana.log, which shows several debug logs, but there are no critical errors indicating a problem.
What I Need Help With:
Despite Kibana being active and listening on port 5601, I cannot access it from either localhost or another machine.
What could be causing this issue, and how can I resolve it? Are there any additional configurations or checks I should consider? Thank you for your assistance!
As discussed in comments,
To resolve this issue, modify the kibana config file and update the server.host setting to 0.0.0.0. This change allows Kibana to accept external connections.
sudo nano /etc/kibana/kibana.yml
Locate the server.host setting and change it to
server.host: "0.0.0.0"
Save the file and restart the Kibana service
sudo systemctl restart kibana
After making this change, Kibana should be accessible both locally and from other machines on the network.