Akvorado

Prerequisites

• An Azure subscription and a resource group.

• An SSH key pair for administrative access to the VM.

• A network security group (NSG) that allows TCP 22 for SSH (restrict it to your admin IP), TCP 80 for the web console (front it with your own TLS or an SSO proxy for production), and UDP 2055, 4739 and 6343 from the routers and switches that export flows.

• A starting size of Standard_B2s (2 vCPU, 4 GiB). Akvorado scales with flow volume, so choose a larger size for busy collectors.

Launch the VM

From the Azure Marketplace (portal)

• Open the Akvorado on Ubuntu 24.04 LTS by SecureAnyCloud offer, select Get it now, then select Create.

• Choose your subscription, resource group and region.

• Pick a VM size (Standard_B2s to start) and provide your SSH public key.

• On the Networking tab, attach an NSG that allows TCP 22 and 80 and UDP 2055, 4739 and 6343, as described in the prerequisites.

• Review and create the VM. When deployment finishes, note the VM's public IP address.

From the Azure CLI

az vm image terms accept --urn sac1647283583153:akvorado-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name akvorado \
  --image sac1647283583153:akvorado-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Open the console and the flow ingestion ports
az vm open-port --resource-group my-rg --name akvorado --port 80 --priority 900
az vm open-port --resource-group my-rg --name akvorado --port 2055 --priority 910

Add the flow ports (UDP 2055 / 4739 / 6343) as additional NSG rules, and open only the protocols your exporters use.

Retrieve the per-VM console password

Akvorado's web console has no built-in login. SecureAnyCloud fronts it with nginx HTTP Basic authentication, using a password generated uniquely on this VM's first boot and written to a root-only file. Connect over SSH and read the file:

sudo cat /root/akvorado-credentials.txt

The file shows the console URL, the username (admin) and the generated password:

AKVORADO_URL=http://<your-vm-ip>/ AKVORADO_CONSOLE_USER=admin AKVORADO_CONSOLE_PASSWORD=<AKVORADO_CONSOLE_PASSWORD>

Confirm the stack is healthy

The whole stack runs as a Docker Compose deployment managed by akvorado.service. Check the systemd units and the containers:

systemctl is-active docker.service nginx.service akvorado-firstboot.service akvorado.service cd /opt/akvorado && sudo docker compose ps

All seven containers should report Up ... (healthy):

akvorado-console Up (healthy) akvorado-inlet Up (healthy) akvorado-orchestrator Up (healthy) akvorado-outlet Up (healthy) clickhouse Up (healthy) kafka Up (healthy) redis Up (healthy)

The console front door answers on port 80. An unauthenticated health probe returns 200, while the console itself requires the per-VM password:

PW=$(sudo grep '^AKVORADO_CONSOLE_PASSWORD=' /root/akvorado-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'health=%{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'no-auth=%{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'auth=%{http_code}\n' -u "admin:$PW" http://127.0.0.1/

health=200 no-auth=401 auth=200

Sign in to the console

Open http://<your-vm-ip>/ in a browser. When the browser prompts for a username and password, enter admin and the password from the credentials file.

The console opens on the Home page, which summarises recent traffic. It shows the flow rate, the exporters seen, the top source AS numbers, ports, protocols and countries, and the fully enriched details of the last flow received. The page stays empty until you point exporters at the VM.

Send flows to Akvorado

Configure your routers, switches or firewalls to export flow records to this VM's IP address on the matching UDP port.

Protocol UDP port

NetFlow (v5 / v9) 2055

IPFIX 4739

sFlow 6343

For example, on a device that exports NetFlow v9, set the collector to <your-vm-ip>:2055. Akvorado's inlet receives the packets, and the outlet enriches them and writes them to ClickHouse. The flows become visible in the console within seconds. Optionally, peer BMP on TCP 10179 to enrich flows with BGP routing information.

Explore traffic in the console

Once flows arrive, use the console's Visualize page to build interactive graphs. Pick a dimension (for example source AS, destination port, protocol or exporter interface) and a time range. Akvorado renders a stacked time series or a Sankey diagram of your traffic.

You can render the same query as line series per source AS, or as a Sankey diagram that shows how traffic flows between source and destination autonomous systems.

Verify flows are stored (optional)

Flows are stored in the ClickHouse flows table. Confirm ingestion directly:

cd /opt/akvorado
sudo docker compose exec -T clickhouse clickhouse-client -q "SELECT count() FROM flows"
sudo docker compose exec -T clickhouse clickhouse-client -q \
  "SELECT SrcAS, count() AS c, sum(Bytes) AS bytes FROM flows GROUP BY SrcAS ORDER BY c DESC LIMIT 5 FORMAT PrettyCompact"

The count grows as flows arrive, and the grouped query shows the busiest source AS numbers:

Security and production hardening

• Rotate the password if needed. Each VM generates its own console password on first boot, so a fresh VM needs no change. To rotate it yourself, run sudo htpasswd -B /etc/nginx/akvorado.htpasswd admin and reload nginx.

• Terminate TLS. The console is served over plain HTTP on port 80. For production, front the VM with your own TLS (for example an Azure Application Gateway or a reverse proxy with a certificate) or restrict port 80 to a management network.

• Use SSO for teams. Akvorado authorises users from a Remote-User header supplied by a front proxy. The nginx front door supplies that header behind a single shared password. For multi-user access, place an SSO proxy (Authelia, Authentik, Keycloak or oauth2-proxy) in front and have it set Remote-User.

• Restrict the flow ports. Open UDP 2055 / 4739 / 6343 only to the exporters that need them.

• Keep the base image patched. Unattended security upgrades stay enabled.

How the appliance is built

• The stack is defined in /opt/akvorado/docker-compose.yaml with configuration under /opt/akvorado/config.

• akvorado-firstboot.service generates the per-VM console password on first boot, writes the nginx htpasswd and the credentials file, and brings the stack up. It runs once, guarded by a sentinel at /var/lib/sac/data/akvorado-firstboot.done.

• akvorado.service keeps the stack running on every subsequent boot.

• akvorado-swap.service adds swap on the ephemeral resource disk at boot, so the memory-heavy stack runs comfortably on small VMs. No swap is baked into the image.

Licensing

Akvorado is free software under the GNU Affero General Public License v3.0 (AGPL-3.0). Because the console is served over a network, the AGPL requires that its complete corresponding source be offered to users. That source is the pinned upstream release used by this image, available at github.com/akvorado/akvorado, tag v2.4.1.

SecureAnyCloud ships stock, unmodified upstream Akvorado and provides only external configuration: the Compose file, configuration files, systemd units and the nginx front door. The SecureAnyCloud charge of $0.04 per vCPU hour covers packaging, security patching, image maintenance and 24/7 support.

Support

SecureAnyCloud provides 24/7 support for this image. If you have any questions about deploying or operating Akvorado on Azure, contact us at sales@secureanycloud.com.

Deploy on Azure

Launch Akvorado on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com