SecureAnyCloud
Deployment guide

gNMIc

Overview

gNMIc is a self-hosted, open-source gNMI client and telemetry collector from OpenConfig. It speaks the gNMI management protocol to your routers and switches, supporting Capabilities, Get, Set and Subscribe. As a collector, it continuously streams operational telemetry from your devices into your observability stack: Prometheus, InfluxDB, Kafka, NATS, TCP, UDP and files.

This SecureAnyCloud image installs the official gNMIc binary at /usr/local/bin/gnmic, running as the gnmic service in collector mode (gnmic subscribe). Its Prometheus output is bound to loopback 127.0.0.1:9804 and its REST api-server to loopback 127.0.0.1:7890, behind nginx on port 80. nginx is ready for your TLS certificate. Targets, subscriptions, outputs and processors are all defined in plain YAML.

Secure by default, with no default login. gNMIc's metrics and api-server endpoints ship with no authentication of their own, and this image never exposes them unauthenticated. The daemon binds both to loopback only, and they are served through nginx. GET /health is an unauthenticated liveness endpoint for load balancer probes, while /metrics, /api/ and every other path require HTTP Basic Auth (username SecureAnyCloud).

The gnmic-firstboot.service oneshot generates a unique password on eachVM's first boot. It writes the password to a root-only file and to an nginx htpasswd, resolves the instance URL, writes a root-only info note, and then disables itself. No two VMs share a password, and none is baked into the image.

Always current. On first boot, the appliance downloads the newest gNMIc release binary, falling back to the baked version if the network is unavailable. Every launch therefore runs current software rather than the version frozen at build time.

Note on the interface. gNMIc is a headless collector with no web UI. You drive it through its YAML configuration (/etc/gnmic/gnmic.yaml), its REST api-server and the gnmic command line, and it exposes telemetry through the outputs you enable. This guide uses curl against the metrics and api-server endpoints and edits the YAML config directly.

What you get:

  • gNMIc (verified at 0.46.0) as the official self-contained binary
  • gnmic.service running gnmic subscribe with the Prometheus output on 127.0.0.1:9804 and the api-server on 127.0.0.1:7890
  • An nginx reverse proxy on port 80, with a public /health and a password-protected /metrics and /api/
  • gnmic-firstboot.service for the first-boot password, binary refresh and info note
  • A unique per-VM API password generated on first boot, in a root-only 0600 file
  • An Ubuntu 24.04 LTS base, patched at build time
  • 24/7 SecureAnyCloud support, 24h response SLA

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet.

gNMIc is lightweight and CPU-friendly. Standard_B2s (2 vCPU, 4 GB RAM) is the recommended VM size and is sufficient for most deployments. Use a larger size only if you collect from a very large number of targets or at a high sample rate.

gNMIc dials out to your devices' gNMI port (commonly TCP 57400, 9339 or 6030), so allow outbound access from the VM to your network devices. No inbound gNMI port is required on the VM itself.

1

Deploy from the Azure Portal

Search the Marketplace for gNMIc on Ubuntu 24.04 and choose your VM size.

Attach a network security group (NSG) that allows TCP 22 (SSH) from your management network. Also allow TCP 80 and 443 (the metrics and API endpoints) from the networks that need to scrape or manage the collector. In production, front port 80 with TLS (see Step 10).

No inbound port is required for gNMIc to collect, because it makes outbound connections to your devices.

2

Deploy from the Azure CLI

RG="gnmic-prod"; LOCATION="eastus"; VM_NAME="gnmic-01" IMAGE_URN="sac1647283583153:gnmic-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name gnmic-vnet --address-prefix 10.90.0.0/16 --subnet-name gnmic-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name gnmic-nsg az network nsg rule create -g "$RG" --nsg-name gnmic-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name gnmic-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:gnmic-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name gnmic-vnet --subnet gnmic-subnet --nsg gnmic-nsg --public-ip-sku Standard
3

Connect via SSH

ssh azureuser@<vm-ip>
4

Verify the services are running

gNMIc's Prometheus output listens on loopback 127.0.0.1:9804 and its api-server on 127.0.0.1:7890. nginx fronts both on port 80. The health endpoint is public, and the metrics and API endpoints require your password.

sudo systemctl start gnmic nginx 2>/dev/null || true
sudo systemctl is-active gnmic nginx ss -tln | grep -E ':80 |127.0.0.1:9804|127.0.0.1:7890' curl -s http://127.0.0.1/health

You should see both services active, three listening sockets (the Prometheus output and the api-server bound to loopback, and nginx on port 80), and ok from the public health endpoint.

5

Read your per-VM API password

The password was generated on this VM's first boot and stored in a root-only file. Read it and keep it secret, because it authenticates every metrics and API request. Then confirm that unauthenticated requests are rejected.

sudo cat /root/gnmic-info.txt echo "unauthenticated /metrics -> HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/metrics)"

The info note holds API_PASSWORD and the instance URLs, and it is owned root:root with mode 0600. An unauthenticated call to /metrics returns 401, because nginx enforces authentication.

6

Query the metrics and the api-server

Load the password into a shell variable and query the endpoints through nginx with HTTP Basic Auth. The Prometheus /metrics endpoint exposes your telemetry for scraping. It returns HTTP 200 and populates once a target streams data. The gNMIc REST api-server reports the configured targets and subscriptions as JSON.

export
GNMIC_PW=$(sudo grep '^API_PASSWORD=' /root/gnmic-info.txt | cut -d= -f2-)
echo "authenticated /metrics -> HTTP $(curl -s -o /dev/null -w '%{http_code}' -u sac:$GNMIC_PW http://127.0.0.1/metrics)"
echo "authenticated /api/v1/config/targets -> HTTP $(curl -s -o /dev/null -w '%{http_code}' -u sac:$GNMIC_PW http://127.0.0.1/api/v1/config/targets)" curl -s -u sac:$GNMIC_PW http://127.0.0.1/api/v1/config/subscriptions | jq . curl -s -u sac:$GNMIC_PW http://127.0.0.1/api/v1/config/targets | jq 'map_values({address, subscriptions})'

Both authenticated calls return 200. The api-server returns the interface-counters subscription (its paths and stream mode) and the configured target. Point an automation system at this endpoint to add targets and subscriptions at runtime.

7

Point gNMIc at your own devices

Out of the box, the collector ships a sample target (your-target:57400) with a sample interface-counters subscription, so the daemon runs immediately. Replace the target with your own gNMI-capable devices. Edit /etc/gnmic/gnmic.yaml, set the target address and credentials, then restart the collector. Substitute <your-domain> with your device's hostname or IP.

sudo sed -i 's/your-target:57400/<your-domain>:57400/' /etc/gnmic/gnmic.yaml
sudo sed -i 's/^username: admin/username: <your-device-user>/' /etc/gnmic/gnmic.yaml
sudo systemctl restart gnmic

Each target is a host:port entry under targets: in the config. The global username, password, skip-verify and encoding settings apply to every target and can be overridden per target.

Define your subscription paths under subscriptions:. Use YANG/OpenConfig paths such as /interfaces/interface/state/counters. See the gNMIc documentation for the full configuration reference.

8

Ad hoc gNMI requests with the CLI

Beyond the collector daemon, the full gnmic command line is available for one-off Capabilities, Get and Set requests against any gNMI target. Substitute <your-domain> with your device.

gnmic -a <your-domain>:57400 -u admin -p 'your-device-password' --skip-verify capabilities gnmic -a <your-domain>:57400 -u admin -p 'your-device-password' --skip-verify get --path /interfaces/interface/state/counters

capabilities lists the models, encodings and gNMI version that the device supports. get performs a one-shot read of a path. These are the same requests the collector makes under the hood.

9

Scrape the metrics from Prometheus

Point your Prometheus server at the collector. Because the endpoint is password-protected, use a basic_auth block in your scrape config. In production, scrape over HTTPS (see Step 10).

scrape_configs: - job_name: gnmic metrics_path: /metrics basic_auth: username: sac password: <the API_PASSWORD from /root/gnmic-info.txt> static_configs: - targets: ['<your-domain>']

gNMIc also supports InfluxDB, Kafka, NATS, TCP, UDP and file outputs. Add them under outputs: in /etc/gnmic/gnmic.yaml and reference them from your targets or subscriptions.

10

Enable HTTPS

nginx fronts the metrics and API endpoints on port 80 and is ready for TLS. Point a DNS record at the VM, then obtain a certificate with certbot and let certbot configure nginx for port 443.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

After the certificate is issued, restrict the NSG so that only 443 (and 22 from your management network) is reachable. Then scrape the metrics over https://<your-domain>/metrics with the password.

Persistence, first boot and updates

The collector configuration (/etc/gnmic/gnmic.yaml) lives on the OS disk and is captured into the image, so a VM launched from this image is ready immediately.

The first-boot service generates the per-VM API password and refreshes the gNMIc binary to the latest release. It then disables itself, so subsequent reboots are unaffected. The OS is patched at build time and ships with unattended security upgrades enabled.

Support

Every SecureAnyCloud deployment includes 24/7 support with a 24-hour response SLA. Contact sales@secureanycloud.com for help with deployment, configuration or scaling.

This is a repackaged open-source software product, with additional charges for SecureAnyCloud support services. gNMIc is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch gNMIc on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure