Arc Time-Series Database

Create the virtual machine from the SecureAnyCloud Arc Time-Series Database on Ubuntu 24.04 image. Choose your resource group, region, size and SSH public key. The 30 GB data disk that carries the Parquet store is defined in the image and is provisioned automatically with the VM, so you do not need to add one.

Once the VM is running, connect over SSH with the admin user that you chose at deployment. On first boot, Arc's first-boot service generates this instance's admin API token and TLS certificate before it allows the database to start. This normally completes within a few seconds of the VM reaching the running state.

Every instance generates its own token. Read it from the root-only credentials file:

sudo cat /root/arc-tsdb-credentials.txt

The file records ARC_ADMIN_TOKEN, the ARC_URL endpoint for this VM and the default database name, along with example curl commands. It is mode 0600 and owned by root, so only a user who can already become root on the VM can read it. Keep it secret, and treat the token as a full administrative credential.

systemctl status arc --no-pager dpkg-query -W -f='arc ${Version}\n' arc ss -ltn | grep 8000 curl -sk https://127.0.0.1:8000/health

arc.service should report active (running), the installed version should be 26.09.1, and Arc should be listening on port 8000 on all interfaces. The /health endpoint is a public liveness probe. It answers without a token and returns a JSON status document.

Arc speaks standard analytical SQL over its HTTPS API. Read the token straight from the credentials file so that you never paste a secret onto the command line:

TOKEN=$(sudo grep '^ARC_ADMIN_TOKEN=' /root/arc-tsdb-credentials.txt | cut -d= -f2-)
curl -sk -X POST https://127.0.0.1:8000/api/v1/query \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"sql":"SELECT 1 AS ok"}'

The response is a JSON document with "success":true, a columns array, a data array of rows and a row_count. Because the query engine is DuckDB, the full analytical SQL surface is available, including common table expressions and window functions:

TOKEN=$(sudo grep '^ARC_ADMIN_TOKEN=' /root/arc-tsdb-credentials.txt | cut -d= -f2-)
curl -sk -X POST https://127.0.0.1:8000/api/v1/query \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"sql":"WITH t AS (SELECT 1 AS v UNION ALL SELECT 2 UNION ALL SELECT 3) SELECT v, sum(v) OVER () AS total FROM t ORDER BY v"}'

Arc accepts the InfluxDB line protocol, so anything that already writes to InfluxDB 1.x, including Telegraf, can point at Arc unchanged. Write a few points, force a flush so that Arc commits them to Parquet immediately, and then query them back:

TOKEN=$(sudo grep '^ARC_ADMIN_TOKEN=' /root/arc-tsdb-credentials.txt | cut -d= -f2-)
NOW=$(date +%s)000000000 curl -sk -o /dev/null -w 'write: HTTP %{http_code}\n' \
  -X POST 'https://127.0.0.1:8000/write?db=sac' \
  -H "Authorization: Bearer $TOKEN" \
  --data-binary "cpu,host=server01 usage=64.2 $NOW" curl -sk -o /dev/null -X POST https://127.0.0.1:8000/api/v1/write/line-protocol/flush \
  -H "Authorization: Bearer $TOKEN" sleep 2 curl -sk -X POST https://127.0.0.1:8000/api/v1/query \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"sql":"SELECT count(*) AS points FROM sac.cpu"}'

A successful write returns HTTP 204. The read-back query returns "success":true with the number of points stored. In normal operation, you do not need to flush by hand. Arc flushes its ingest buffer automatically, and the explicit flush here only makes the round trip immediate for this walkthrough.

Measurements become tables inside the database that you wrote to, so a point written to measurement cpu in database SecureAnyCloud is queried as sac.cpu. List what a database currently holds with the measurements endpoint:

TOKEN=$(sudo grep '^ARC_ADMIN_TOKEN=' /root/arc-tsdb-credentials.txt | cut -d= -f2-)
curl -sk -H "Authorization: Bearer $TOKEN" https://127.0.0.1:8000/api/v1/measurements

Every data route requires the bearer token. The only endpoints that answer without one are the two liveness probes (/health, /ready) and the two monitoring endpoints (/metrics, /api/v1/metrics). The monitoring endpoints expose aggregate counters and no data. Confirm all four cases:

TOKEN=$(sudo grep '^ARC_ADMIN_TOKEN=' /root/arc-tsdb-credentials.txt | cut -d= -f2-)
echo "public /health : HTTP $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1:8000/health)"
echo "no token /query : HTTP $(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:8000/api/v1/query -H 'Content-Type: application/json' -d '{"sql":"SELECT 1"}')"
echo "bad token /query : HTTP $(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:8000/api/v1/query -H 'Authorization: Bearer not-a-real-token' -H 'Content-Type: application/json' -d '{"sql":"SELECT 1"}')"
echo "good token /query : HTTP $(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:8000/api/v1/query -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"sql":"SELECT 1"}')" curl -sk -X POST https://127.0.0.1:8000/api/v1/query -H 'Content-Type: application/json' -d '{"sql":"SELECT 1"}'

The public health probe returns 200. The query with no token and the query with a wrong token both return 401 with an "Authentication required" error body and no data. Only the request that carries this VM's token returns 200. The same applies to the write and measurements routes.

You can confirm the rest of the public surface the same way. The two monitoring endpoints answer without a token, while the application log route and the Go profiling endpoints require one:

echo "public /metrics : HTTP $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1:8000/metrics)"
echo "public /api/v1/metrics : HTTP $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1:8000/api/v1/metrics)"
echo "gated /api/v1/logs : HTTP $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1:8000/api/v1/logs)"
echo "gated /debug/pprof/ : HTTP $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1:8000/debug/pprof/)"

The two monitoring endpoints return 200 and are safe to point Prometheus at. /api/v1/logs and the profiling endpoints return 401. If you do not want the monitoring endpoints reachable from outside the VM, restrict port 8000 in your network security group to the addresses that need it.

sudo stat -c '%a %U:%G %n' /root/arc-tsdb-credentials.txt /etc/arc/arc.toml /etc/arc/tls/arc.key df -h /var/lib/arc/data | tail -1 findmnt -no SOURCE,FSTYPE,SIZE /var/lib/arc/data
sudo find /var/lib/arc/data -name '*.parquet' | head -3 getent passwd arc
sudo grep -E '^(tls_enabled|enabled|local_path|db_path)' /etc/arc/arc.toml

The credentials file is 0600 root:root, the Parquet store is on the dedicated data disk rather than the OS disk,Arc runs as a non-login system user, and the configuration shows TLS enabled and telemetry disabled. Arc writes your time series data as ordinary Parquet files under /var/lib/arc/data, organized by database, measurement and time. You can read the files directly with DuckDB, pandas, polars or any other Parquet reader.