InfluxDB Telegraf Grafana

In the Azure Portal, open the Marketplace, search for TIG Stack, select the SecureAnyCloud publisher entry and select Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range. Also allow TCP 3000 (Grafana) from your trusted client networks, and TCP 8086 if you want the InfluxDB UI. Do not expose ports 3000 or 8086 to the public internet without TLS. Both serve plain HTTP by design, so terminate TLS at a reverse proxy.

Select Review + create, wait for validation, then select Create. Deployment takes around two minutes.

Create the resource group, network, network security group and VM from the gallery image:

RG="observability-prod" LOCATION="eastus" VM_NAME="tig-01" ADMIN_USER="azureuser" GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-sac/providers/Microsoft.Compute/galleries/sacGallery/images/influxdb-telegraf-grafana/versions/<version>" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name tig-vnet --address-prefix 10.95.0.0/16 \
  --subnet-name tig-subnet --subnet-prefix 10.95.1.0/24 az network nsg create --resource-group "$RG" --name tig-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name tig-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name tig-nsg \
  --name allow-grafana --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 3000 --access Allow --protocol Tcp az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name tig-vnet --subnet tig-subnet --nsg tig-nsg \
  --public-ip-sku Standard

Connect as the admin user:

ssh azureuser@<vm-ip>

On first boot, InfluxDB starts and tig-firstboot.service onboards it. The service then wires the operator token into Telegraf and Grafana, rotates the Grafana admin password, and starts Telegraf and Grafana.

Confirm all three services are active:

sudo systemctl is-active influxdb telegraf grafana-server

Expect three lines, each reading active. Then confirm the listeners: Grafana on 3000 and InfluxDB on 8086. Telegraf is a push agent with no listening port.

sudo ss -tlnp | grep -E ':(3000|8086) '

Confirm the first-boot sentinel and Grafana health:

sudo test -f /var/lib/sac/data/tig-firstboot.done && echo FIRSTBOOT_DONE curl -s http://localhost:3000/api/health

You should see FIRSTBOOT_DONE and Grafana reporting that its database is ok:

FIRSTBOOT_DONE { "database": "ok", "version": "13.1.1", "commit": "a9cee6e1724a455676bb6c05eef7fc54aa4b19f4" }

InfluxDB should report that it is healthy and ready for queries and writes:

curl -s http://localhost:8086/health

{"name":"influxdb", "message":"ready for queries and writes", "status":"pass", "checks":[], "version": "v2.9.1", "commit": "d4fa1941fd"}

Prove that Telegraf is writing host metrics into the InfluxDB telegraf bucket. This command reads the operator token from the credentials file and runs a Flux query for the latest CPU idle value:

TOKEN=$(sudo grep '^INFLUXDB_ADMIN_TOKEN=' /root/influxdb-telegraf-grafana-credentials.txt | cut -d= -f2-)
curl -s -H "Authorization: Token $TOKEN" \
  -H 'Content-Type: application/vnd.flux' -H 'Accept: application/csv' \
  -X POST "http://localhost:8086/api/v2/query?org=sac" \
  --data-binary 'from(bucket:"telegraf") |> range(start:-2m) |> filter(fn:(r)=>r._measurement=="cpu" and r.cpu=="cpu-total" and r._field=="usage_idle") |> last()'

A recent value confirms that the full path from Telegraf to InfluxDB is live:

,result,table,_start,_stop,_time,_value,_field,_measurement,cpu,host ,_result,0,2026-07-28T08:21:26Z,2026-07-28T08:23:26Z,2026-07-28T08:23:20Z,99.44834503510582,usage_idle,cpu,cpu-total,tig-01

Print the credentials file:

sudo cat /root/influxdb-telegraf-grafana-credentials.txt

The file contains the per-VM Grafana and InfluxDB credentials:

GRAFANA_ADMIN_USER=admin GRAFANA_ADMIN_PASSWORD=<generated per VM> GRAFANA_URL=http://<vm-ip>:3000 INFLUXDB_ADMIN_USER=admin INFLUXDB_ADMIN_PASSWORD=<generated per VM> INFLUXDB_ADMIN_TOKEN=<generated per VM> INFLUXDB_ORG=sac INFLUXDB_BUCKET=telegraf INFLUXDB_URL=http://<vm-ip>:8086

Store the passwords and token in your secret store. The file is mode 0600, readable by root only.

Prove that metrics flow all the way through. This command asks Grafana to health-check its provisioned InfluxDB datasource, which authenticates to InfluxDB with the per-VM token and confirms that it can read the buckets:

PW=$(sudo grep '^GRAFANA_ADMIN_PASSWORD=' /root/influxdb-telegraf-grafana-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://localhost:3000/api/datasources/uid/sac-influxdb/health

{"message":"datasource is working. 3 buckets found","status":"OK"}

The default admin/admin login has been rotated away, so Grafana rejects it:

curl -s -o /dev/null -w '%{http_code}\n' -u "admin:admin" http://localhost:3000/api/user

You should see 401.

Open http://<vm-ip>:3000 in your browser to see the Grafana sign-in page.

Sign in with admin and the GRAFANA_ADMIN_PASSWORD from Step 6. Grafana rejects the default admin/admin login because it has been rotated away.

Grafana ships with a Host Metrics (SecureAnyCloud) dashboard, already provisioned under the SecureAnyCloud folder. Open it from Dashboards. It renders live host metrics immediately from the InfluxDB datasource: CPU busy, memory used, root filesystem used, system load, CPU usage over time and network traffic.

The dashboard is defined at /var/lib/grafana/dashboards/host-metrics.json and reloads automatically. Edit it in the UI, or drop additional dashboard JSON files into that directory.

Under Connections, then Data sources, the InfluxDB datasource is already configured as the default. It uses the Flux query language against http://127.0.0.1:8086, with organization SecureAnyCloud and default bucket telegraf.

You never need to add or configure it. It is provisioned from /etc/grafana/provisioning/datasources/sac-influxdb.yaml, and its token is read from /etc/grafana/sac/influx-token, which is populated per VM at first boot. No secret is baked into the image.

InfluxDB 2 has its own web interface for the Data Explorer, Buckets, Tasks and Alerts. Open http://<vm-ip>:8086 and sign in with admin and the INFLUXDB_ADMIN_PASSWORD from Step 6.

From the UI, you can build Flux queries against the telegraf bucket, create additional buckets and retention policies, and manage API tokens.

Telegraf supports more than 300 input plugins. To collect more data, drop a .conf file into /etc/telegraf/telegraf.d/. For example, you can also scrape a local Docker daemon or an nginx status endpoint. List the current configuration files with:

sudo ls -1 /etc/telegraf/telegraf.d/

The SecureAnyCloud host-metrics configuration is at /etc/telegraf/telegraf.d/sac.conf. After you add inputs, validate the configuration and restart Telegraf:

sudo -u telegraf telegraf --config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d --test 2>&1 | head -5 sudo systemctl restart telegraf.service

New measurements appear in the telegraf bucket automatically. You can chart them in Grafana against the InfluxDB datasource.

The stack installs these components and files:

• InfluxDB binary: /usr/bin/influxd
• InfluxDB CLI: /usr/bin/influx
• InfluxDB config: /etc/influxdb/config.toml
• InfluxDB data: /var/lib/influxdb/
• Telegraf config: /etc/telegraf/telegraf.conf
• Telegraf host-metrics config: /etc/telegraf/telegraf.d/sac.conf
• Telegraf token env file: /etc/default/telegraf
• Grafana server binary: /usr/sbin/grafana-server
• Grafana config: /etc/grafana/grafana.ini
• Provisioned datasource: /etc/grafana/provisioning/datasources/sac-influxdb.yaml
• Provisioned dashboards: /var/lib/grafana/dashboards/
• Credentials file: /root/influxdb-telegraf-grafana-credentials.txt
• First-boot sentinel: /var/lib/sac/data/tig-firstboot.done

Inspect the installed versions:

dpkg-query -W -f='influxdb2 ${Version}\n' influxdb2 dpkg-query -W -f='telegraf ${Version}\n' telegraf dpkg-query -W -f='grafana ${Version}\n' grafana

influxdb2 2.9.1-1 telegraf 1.39.2-1 grafana 13.1.1

Check the status of a service:

sudo systemctl status grafana-server.service --no-pager

Stop, start or restart each service independently:

sudo systemctl restart influxdb.service
sudo systemctl restart telegraf.service
sudo systemctl restart grafana-server.service

View the logs:

sudo journalctl -u telegraf.service --no-pager -n 50
sudo tail -n 50 /var/log/grafana/grafana.log

Reset the Grafana admin password if you lose it:

sudo grafana-cli admin reset-admin-password '<new-password>'

Grafana and InfluxDB listen on plain HTTP by design, so terminate TLS at a reverse proxy. For example, run Nginx or Caddy on the same VM, proxying https://:443 to http://localhost:3000. Alternatively, use an Azure Application Gateway with TLS termination that routes to the VM private IP.

Restrict the network security group so that ports 3000 and 8086 are reachable only from the proxy. The SecureAnyCloud nginx-ssl-certbot-ubuntu-24-04 image is a purpose-built companion reverse proxy.

Cannot reach Grafana on port 3000

• Confirm the service: sudo systemctl status grafana-server.service
• Confirm the listener: sudo ss -tln | grep 3000
• Check the log: sudo tail -n 50 /var/log/grafana/grafana.log
• Confirm that the network security group allows TCP 3000 from your client source IP.

Dashboard shows "No data"

• Confirm that Telegraf is active and writing: sudo systemctl status telegraf.service
• Check the Telegraf journal for write errors: sudo journalctl -u telegraf.service --no-pager -n 50
• Widen the dashboard time range (top right) to the last 15 minutes.

Grafana did not rotate the admin password

• Check the first-boot service: sudo journalctl -u tig-firstboot.service --no-pager
• Find the per-VM password in /root/influxdb-telegraf-grafana-credentials.txt. Read it with sudo cat.

InfluxDB rejects the token

• Confirm that onboarding completed: curl -s http://localhost:8086/api/v2/setup should report "allowed":false
• Re-read the token from /root/influxdb-telegraf-grafana-credentials.txt.

• Change the Grafana admin password again from the UI after your first login (Profile, then Change Password).
• Create per-user accounts in both Grafana and InfluxDB, and never share the admin login.
• Restrict port 22 to your management IP ranges only.
• Restrict ports 3000 and 8086 to trusted client networks, and pair them with TLS as described in Step 15.
• Rotate the InfluxDB operator token, and issue scoped read and write tokens per application from the InfluxDB UI.
• Shred the credentials file once the secrets are stored in your secret store: sudo shred -u /root/influxdb-telegraf-grafana-credentials.txt

InfluxDB 2 and Telegraf are licensed under the MIT License. Grafana is licensed under the GNU Affero General Public License version 3 (AGPLv3). There is no per-user, per-dashboard or per-server fee.

InfluxDB and Telegraf are trademarks of InfluxData Inc. Grafana is a registered trademark of Grafana Labs. SecureAnyCloud is not affiliated with, sponsored by or endorsed by InfluxData or Grafana Labs. The products are bundled unmodified, for identification only.

SecureAnyCloud provides commercial support for this image, separately from the upstream projects.

Email: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7, with a 24-hour response SLA

Deploy on Azure

Launch the TIG Stack on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch TIG Stack (Telegraf + InfluxDB + Grafana) on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com