Icinga 2

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Size up for more monitored hosts, higher check volumes or longer history retention.

Configure the NSG with these inbound rules:

• Allow 22/tcp from your management network.
• Allow 443/tcp for Icinga Web 2.
• Optionally allow 80/tcp. It only redirects to 443.
• To monitor remote hosts or agents that connect to the Icinga 2 API and cluster port, also allow 5665/tcp.

Icinga Web 2 is served with a per-VM self-signed certificate. For production, install a certificate for your own domain.

The bundled MariaDB, the Icinga DB Redis store and the Icinga 2 API are never exposed by the NSG. Only ports 22, 80 and 443 are opened.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Icinga 2 by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Review the dedicated data disk on the Disks tab. Then select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:icinga-2-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name icinga2 \
  --image sac1647283583153:icinga-2-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 443 to Icinga Web 2:

az vm open-port --resource-group <your-rg> --name icinga2 --port 443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that MariaDB, the Icinga DB Redis store, the Icinga 2 core, the Icinga DB daemon, PHP FPM and nginx are all active.

nginx serves Icinga Web 2 on port 443 and redirects 80 to 443. The NSG never opens MariaDB (3306), the Icinga DB Redis store (6380) or the Icinga 2 API (5665).

systemctl is-active mariadb icingadb-redis icinga2 icingadb php8.3-fpm nginx

ss -tlnp | grep -E ':443 |:3306 |:6380 |:5665 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own Icinga Web 2 administrator password on first boot. It writes the password, along with the login user and URL, to a root-only credentials file. Read it with sudo:

sudo cat /root/icinga2-credentials.txt

Sign in to Icinga Web 2 as user icingaadmin with the ICINGAWEB_ADMIN_PASSWORD from this file.

The file also records the internal service credentials: the Icinga 2 API user and the two database users. All of them are loopback-only and never opened by the NSG. On the VM itself, run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to Icinga Web 2

Browse to https://<vm-public-ip>/ and sign in with username icingaadmin and the password from Step 4. The certificate is a per-VM self-signed certificate, so your browser shows a one-time warning that you can accept. Install your own certificate for production.

After you sign in, you land on the Icinga DB dashboard. The appliance monitors itself out of the box, so the dashboard already shows live data: the state of the monitored host and its services.

The left menu gives you Dashboards, Icinga DB (Hosts, Services, History), Overview, Notifications, Reporting, System and Configuration.

Step 6 - Explore the monitored hosts

Open Icinga DB, then Hosts, to see every monitored host. Out of the box, the appliance's own host is present and reporting, with its current state, check output and the timestamp of its last check. This is the appliance monitoring itself.

Step 7 - Explore the monitored services

Open Icinga DB, then Services, to see every service check. The standard Icinga templates and the monitoring plugins already check the bundled host for load, disk usage, memory, processes, users, SSH and more, so live service state flows immediately. Select any service to see its history, its check output and its performance data.

To monitor a remote host, install an Icinga 2 agent on the target and connect it to this appliance's Icinga 2 API on port 5665. Open 5665/tcp in the NSG. Then add the host through Configuration or your Icinga 2 configuration.

Step 8 - Verify there is no default login

A stock Icinga Web 2 install has no seeded account and presents a setup wizard on first use. The SecureAnyCloud image removes that exposure. The admin is pre-provisioned. On the first boot of every VM, a unique administrator password is generated and every internal service credential is regenerated. Nothing usable is baked into the image.

Run the built-in round-trip check. It proves that the per-VM administrator password matches the stored hash and that exactly one web user exists. It also proves that the Icinga 2 API user authenticates while a wrong password is rejected:

sudo bash /usr/local/sbin/icinga2-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

Confirm the installed versions, that the /healthz endpoint answers, that the databases live on the dedicated data disk, and that live self-monitoring data is flowing:

for p in icinga2 icingadb icingaweb2; do printf '%s %s\n' "$p" "$(dpkg-query -W -f='${Version}' $p 2>/dev/null)"; done

curl -ksI https://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/mysql

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT((SELECT COUNT(*) FROM icingadb.host),' host(s) and ',(SELECT COUNT(*) FROM icingadb.service),' service(s) monitored') AS monitoring"

The databases sit on a dedicated Azure data disk mounted at /var/lib/mysql, separate from the OS disk. You can size, snapshot and grow your monitoring history independently. Everything you need to monitor your estate with Icinga 2 is ready the moment the VM boots.

SecureAnyCloud backs this image with 24/7 support. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Icinga 2 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com