InfluxDB 2

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Scale up for higher ingest rates.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 8086/tcp from the hosts and workstations that will write and query data. Do not expose 8086/tcp to the whole internet.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for InfluxDB by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22). Then select Review + create and Create.

Once the VM exists, add an inbound rule for 8086/tcp scoped to your own address range.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:influxdb-2-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name influxdb \
  --image sac1647283583153:influxdb-2-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open the API and UI port, scoped to your own address range rather than the whole internet:

az vm open-port --resource-group <your-rg> --name influxdb --port 8086 --priority 1001

Step 3 - Retrieve the per-VM credentials

A unique admin password and a unique operator API token are generated on the first boot of every VM and written to a root-only credentials file. SSH in and read the file:

ssh azureuser@<vm-public-ip>
sudo cat /root/influxdb-credentials.txt

The file is 0600 root:root and contains the URL, the organization, the bucket, the admin login and the operator token:

INFLUXDB_URL=https://<vm-public-ip>:8086 influxdb.host=<vm-public-ip> influxdb.port=8086 influxdb.username=admin influxdb.password=<INFLUXDB_PASSWORD> influxdb.org=sac influxdb.bucket=metrics influxdb.token=<INFLUXDB_TOKEN>

The password signs you in to the web UI. The token authenticates API and influx CLI requests. Keep both safe. They are unique to this VM and are shown in plain text only in this file.

Step 4 - Confirm InfluxDB is healthy

systemctl is-active influxdb influxd version curl -ks https://127.0.0.1:8086/health

/health reports "status":"pass" once the server is ready for reads and writes:

Note the -k on curl. The certificate is self-signed and unique to this VM, so clients either skip verification or trust the certificate explicitly. Replacing it with your own certificate is covered below.

Step 5 - Sign in to the web UI

Browse to https://<vm-public-ip>:8086/. Your browser warns once about the self-signed certificate. Accept it to continue. Sign in as admin with the password from the credentials file:

After you sign in, you land on the getting-started page. It links the client libraries, the CLI and Telegraf, and shows the running version in the lower right:

You can also verify the password from the command line. The sign-in endpoint answers 204 for the per-VM password:

PASSWORD=$(sudo sed -n 's/^influxdb.password=//p' /root/influxdb-credentials.txt)
curl -ks -o /dev/null -w 'signin: %{http_code}\n' -XPOST https://127.0.0.1:8086/api/v2/signin -u "admin:$PASSWORD"

Step 6 - Write your first points

Every write is authenticated with the operator token and addressed to an organization and a bucket. Read the token out of the credentials file and post a point in line protocol. A successful write returns 204:

TOKEN=$(sudo sed -n 's/^influxdb.token=//p' /root/influxdb-credentials.txt)
curl -ks -o /dev/null -w 'write: %{http_code}\n' \
  -XPOST "https://127.0.0.1:8086/api/v2/write?org=sac&bucket=metrics&precision=s" \
  -H "Authorization: Token $TOKEN" \
  --data-binary "cpu,host=web-01 usage=63.5 $(date +%s)"

Line protocol is measurement,tag=value field=value timestamp. Tags are indexed and are what you filter and group by. Fields hold the numbers.

Step 7 - Query it back with Flux

The influx CLI ships with the image. Because the certificate is self-signed, pass --skip-verify. The CLI does not accept curl's -k:

TOKEN=$(sudo sed -n 's/^influxdb.token=//p' /root/influxdb-credentials.txt) influx query --skip-verify --host https://127.0.0.1:8086 -t "$TOKEN" -o sac \
  'from(bucket:"metrics") |> range(start:-15m) |> filter(fn:(r) => r._measurement == "cpu")'

The same query over the raw HTTP API returns annotated CSV:

TOKEN=$(sudo sed -n 's/^influxdb.token=//p' /root/influxdb-credentials.txt)
curl -ks -XPOST "https://127.0.0.1:8086/api/v2/query?org=sac" \
  -H "Authorization: Token $TOKEN" \
  -H 'Accept: application/csv' \
  -H 'Content-Type: application/vnd.flux' \
  --data 'from(bucket:"metrics") |> range(start:-15m) |> filter(fn:(r) => r._measurement == "cpu") |> last()'

The web UI runs the same query interactively. Open Data Explorer from the left-hand navigation. Assemble the query with the point-and-click Query Builder, or switch to Script Editor and write Flux directly. Then select Submit:

The image seeds a small sac_demo measurement on first boot, so the Data Explorer has something to draw before you send any data of your own.

Step 8 - Buckets and retention

Data lives in buckets, and each bucket has a retention policy that expires points automatically. The image creates metrics with infinite retention. Open Load Data -> Buckets to see it, change its retention or create more:

To manage buckets from the command line:

TOKEN=$(sudo sed -n 's/^influxdb.token=//p' /root/influxdb-credentials.txt) influx bucket list --skip-verify --host https://127.0.0.1:8086 -t "$TOKEN" -o sac

Create a bucket that keeps 30 days of data:

influx bucket create --skip-verify --host https://127.0.0.1:8086 -t "$TOKEN" \
  -o sac -n telemetry -r 30d

Step 9 - How access is protected

InfluxDB authorizes every API request with a token, and this image serves the API only over TLS. Requests with no token, a guessed token or a common default password are all rejected with 401. The instance is already claimed, so nobody can run the setup wizard against it:

curl -ks -o /dev/null -w 'no token: %{http_code}\n' https://127.0.0.1:8086/api/v2/buckets
curl -ks -o /dev/null -w 'guessed token: %{http_code}\n' https://127.0.0.1:8086/api/v2/buckets -H 'Authorization: Token admin'
curl -ks -o /dev/null -w 'weak password: %{http_code}\n' -XPOST https://127.0.0.1:8086/api/v2/signin -u admin:password
curl -ks https://127.0.0.1:8086/api/v2/setup

"allowed": false from /api/v2/setup is the proof that this instance has already been bootstrapped with your per-VM credentials.

Issue additional, narrower tokens instead of sharing the operator token with applications. For example, create a write-only token for one bucket:

influx auth create --skip-verify --host https://127.0.0.1:8086 -t "$TOKEN" \
  -o sac --write-bucket <bucket-id> --description "telegraf write-only"

The Azure network security group remains your first line of defense. Keep 8086/tcp scoped to the hosts that need it.

Step 10 - Collect metrics with Telegraf

Telegraf is InfluxData's collection agent and the usual way to fill a bucket. Install it from the same repository this image already trusts, then point it at the local server:

sudo apt-get update && sudo apt-get install -y telegraf

In /etc/telegraf/telegraf.conf set the output plugin:

[[outputs.influxdb_v2]] urls = ["https://127.0.0.1:8086"] token = "<INFLUXDB_TOKEN>" organization = "sac" bucket = "metrics" insecure_skip_verify = true

Then sudo systemctl restart telegraf. Any client library works the same way. The URL, the token, the organization and the bucket are all you need.

Replacing the self-signed TLS certificate

The image mints a self-signed certificate per VM, so nothing is ever served in plaintext. To use your own certificate, replace the two files and restart:

sudo install -o influxdb -g influxdb -m 0644 fullchain.pem /etc/influxdb/tls/influxdb-server.crt
sudo install -o influxdb -g influxdb -m 0600 privkey.pem /etc/influxdb/tls/influxdb-server.key
sudo systemctl restart influxdb

The paths are set in /etc/influxdb/config.toml. Keep the same filenames, and no configuration change is needed. Clients can then drop -k and --skip-verify.

Maintenance

Check where the configuration and data live:

ls -l /etc/influxdb/config.toml
sudo ls -ld /var/lib/influxdb

Read the service log:

sudo journalctl -u influxdb --no-pager -n 20

Back up a bucket to a directory. The backup includes the metadata store, so keep it as private as the credentials file:

influx backup --skip-verify --host https://127.0.0.1:8086 -t "$TOKEN" /var/backups/influxdb-$(date +%F)

Upgrades come from the InfluxData repository the image already trusts:

sudo apt-get update && sudo apt-get install --only-upgrade influxdb2 influxdb2-cli
sudo systemctl restart influxdb

Security updates for the operating system are applied automatically by unattended-upgrades.

Troubleshooting

The service is not running after a reboot. InfluxDB is deliberately gated on a bootstrap-ready marker written by the first-boot service, so it can never serve an un-bootstrapped instance. Confirm both are in order:

systemctl is-enabled influxdb
systemctl show influxdb-firstboot.service --property=ActiveState --value sudo ls -l /var/lib/sac/data/influxdb-ready

If the marker is missing, the first-boot service did not finish. Check its log to see why:

sudo tail -20 /var/log/sac/sac-firstboot.log

curl reports a certificate problem. This is expected with the per-VM self-signed certificate. Use -k with curl or --skip-verify with influx, or install your own certificate as above.

A write returns 401. The token is wrong or missing. Re-read it from /root/influxdb-credentials.txt. The header must be exactly Authorization: Token <token>.

A write returns 404. The organization or bucket name in the query string does not exist. List them with influx bucket list as in Step 8.

Support

This image is published and supported by SecureAnyCloud. For assistance, email sales@secureanycloud.com.

Deploy on Azure

Launch InfluxDB 2.9 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com