Apache HertzBeat

Search the Marketplace for Apache HertzBeat on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network and TCP 1157 (the console and REST API) from the networks that need it. Put HertzBeat behind TLS (see Step 11).

RG="hertzbeat-prod"; LOCATION="eastus"; VM_NAME="hertzbeat-01" IMAGE_URN="sac1647283583153:hertzbeat-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name hertzbeat-vnet --address-prefix 10.90.0.0/16 --subnet-name hertzbeat-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name hertzbeat-nsg az network nsg rule create -g "$RG" --nsg-name hertzbeat-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name hertzbeat-nsg --name allow-console --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 1157 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:hertzbeat-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name hertzbeat-vnet --subnet hertzbeat-subnet --nsg hertzbeat-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

HertzBeat runs as the hertzbeat system user and listens on port 1157 for both the web console and the REST API.

sudo systemctl is-active hertzbeat
sudo ss -tln | grep ':1157' curl -s -o /dev/null -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1:1157/

The service reports active, the JVM is listening on :1157, and the console returns HTTP 200.

There is no shared default login. On first boot the image generates a unique administrator password for this VM and stores it in a root-only file. Read it over SSH:

sudo cat /root/hertzbeat-credentials.txt 2>/dev/null || echo "credentials are generated on first boot"

The file lists the console URL and your unique admin password (mode 0600, owner root). Keep it safe. You can rotate the password later from the console under Settings.

The web console and the REST API both answer on port 1157. The POST /api/account/auth/form endpoint exchanges your admin credentials for a JWT.

curl -s -o /dev/null -w 'console -> HTTP %{http_code}\n' http://127.0.0.1:1157/
PW=$(sudo sed -n 's/^HERTZBEAT_ADMIN_PASSWORD=//p' /root/hertzbeat-credentials.txt 2>/dev/null)
curl -s -X POST http://127.0.0.1:1157/api/account/auth/form \
  -H 'Content-Type: application/json' \
  -d "{\"identifier\":\"admin\",\"credential\":\"${PW:-<admin-password>}\"}" \
  | python3 -c 'import sys,json;d=json.load(sys.stdin);print("REST auth OK, JWT issued" if d.get("data",{}).get("token") else "sign in with the password from /root/hertzbeat-credentials.txt")'

The console returns HTTP 200 and the REST API issues a JWT for the per-VM admin password.

Open http://<vm-ip>:1157/ in your browser. Sign in with the username admin and the password from /root/hertzbeat-credentials.txt. HertzBeat shows the "update the initial default password" banner only for the upstream default. This image has already rotated that default away, so your instance starts with a unique credential.

After you sign in, you land on the dashboard. It shows monitor category cards across the top, a label overview and a real-time status summary.

From the left menu open Monitors, click New Monitor and choose a monitor type such as Website. Enter the Target Host and Port, give the task a name and set the collection interval. Then click OK. HertzBeat starts collecting immediately.

Click the monitor to open its detail view. The real-time detail shows the monitoring basics and the live collected metrics, such as the response time. The historical charts tab plots them over time.

HertzBeat runs as a single node with embedded storage, so there is nothing else to deploy. Metadata lives in an embedded H2 database and metric history in embedded DuckDB, both under /opt/hertzbeat/data.

grep -E 'jdbc:h2|store-path: data/history' /opt/hertzbeat/config/application.yml | sed 's/^ *//'
sudo ls -lh /opt/hertzbeat/data/ 2>/dev/null | grep -E 'hertzbeat|history' || echo 'data dir initialises on first boot'

The H2 metadata file and the DuckDB history store are configured under the data directory, which is captured into the image and carried onto every instance.

A hertzbeat-firstboot.service oneshot runs once, ordered before hertzbeat.service, and rewrites the shipped configuration with per-VM secrets before the application ever starts.

systemctl is-enabled hertzbeat-firstboot.service
sudo stat -c '%n perms=%a owner=%U:%G' /root/hertzbeat-credentials.txt 2>/dev/null || echo 'credentials file is created on first boot' apt-mark showhold

The first-boot service is enabled for the next fresh instance, the credentials file is root-only, and there are no held packages, so the OS security baseline is intact.

Put HertzBeat behind a TLS reverse proxy. Install nginx, point a DNS record at your VM, obtain a certificate with certbot, and proxy port 443 to 127.0.0.1:1157:

sudo apt-get install -y nginx certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

Configure the nginx server block to proxy_pass http://127.0.0.1:1157; Then restrict the NSG so only nginx (ports 80 and 443) is reachable from the internet, and keep port 1157 internal.