Jaeger 2

sudo systemctl is-active jaeger nginx
sudo test -f /var/lib/sac/data/jaeger-2-firstboot.done && echo "firstboot: complete" || echo "firstboot: missing" /opt/jaeger/jaeger --version 2>&1 | head -1

Both jaeger and nginx report active. The first-boot oneshot generates the per-VM nginx htpasswd password and the credentials log. It then writes a sentinel file and exits cleanly. The Jaeger binary reports its git version as v2.17.0.

sudo cat /var/lib/sac/secrets/sac-credentials.txt

Note JAEGER_PASSWORD, the SecureAnyCloud user's password. You enter it at the nginx HTTP basic-auth prompt when you browse to the Web UI.

The file also lists the trace-ingest endpoints: OTLP_GRPC, OTLP_HTTP, JAEGER_GRPC, JAEGER_THRIFT_HTTP and JAEGER_THRIFT_UDP. JAEGER_URL is the canonical browser entry point, and JAEGER_ADMIN_HEALTH_URL points at the healthcheckv2 endpoint behind basic-auth. The file is root:root 0600.

curl -s http://127.0.0.1:14269/status | head -c 400
PASS=$(sudo grep '^JAEGER_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -s -u sac:$PASS http://127.0.0.1/admin/status | head -c 400

The first request calls Jaeger's healthcheckv2 extension directly on the loopback admin port. It returns a JSON status document confirming that all components are healthy.

The second request goes through nginx with HTTP basic-auth and returns the same document. This confirms that the full reverse-proxy chain is wired correctly.

curl -sf -X POST -H 'Content-Type: application/json' \
  --data '{"resourceSpans":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"hello-sac"}}]},"scopeSpans":[{"scope":{"name":"manual"},"spans":[{"traceId":"5b8aa5a2d2c872e8321cf37308d69df2","spanId":"051581bf3cb55c13","name":"manual-span","startTimeUnixNano":"1746000000000000000","endTimeUnixNano":"1746000001000000000","kind":1}]}]}]}' \
  http://127.0.0.1:4318/v1/traces && echo "trace ingested"

This command sends a minimal valid OTLP JSON trace with service.name=hello-sac to the OTLP HTTP receiver. The receiver routes it through the batch processor and writes it to the Badger backend via the jaeger_storage_exporter. The trace is now searchable in the Web UI.

Browse to http://<vm-ip>/ and authenticate as SecureAnyCloud with <JAEGER_PASSWORD> at the nginx HTTP basic-auth prompt.

The Search page opens by default. Pick a service from the dropdown and click Find Traces. The trace you posted in Step 7 appears in the results.

Open the Search menu and choose System Architecture. Jaeger renders a force-directed graph of every service that has emitted spans. Edges show the parent-child call relationships derived from the trace context.

With a single hello-sac trace ingested, the graph shows one node. In production, with thousands of spans per minute, it shows your full service mesh.

Click a trace in the Search results to open the trace detail view. It shows a Gantt-style flame graph of every span in the trace, with timing data, tags, logs and process info.

Use this view to debug latency bottlenecks. Hover over the longest span to see its duration, then expand its tags to see HTTP status codes, database queries and custom attributes.

Component and path:

jaeger binary /opt/jaeger/jaeger (symlink to /opt/jaeger-2.17.0/jaeger)

Config /etc/jaeger/config.yaml

Badger storage /var/lib/jaeger/badger/ (live), /var/lib/jaeger/badger-archive/ (archive)

systemd unit /etc/systemd/system/jaeger.service

Firstboot script /usr/local/sbin/jaeger-2-firstboot.sh

Firstboot service /etc/systemd/system/jaeger-2-firstboot.service

nginx site config /etc/nginx/sites-enabled/jaeger-sac

nginx htpasswd /etc/nginx/.htpasswd-jaeger (root:www-data 0640)

Credentials /var/lib/sac/secrets/sac-credentials.txt (root:root 0600)

Logs journalctl -u jaeger, /var/log/sac/sac-firstboot.log

• Switch Badger to OpenSearch, Elasticsearch or Cassandra. Edit /etc/jaeger/config.yaml, replace the jaeger_storage Badger backend with the appropriate config block, and restart jaeger.service. Badger is single-node only.
• Restrict the NSG. Keep 80/tcp open only to your CDN, load balancer or VPN CIDR, and lock 22/tcp to your management CIDR.
• Add TLS. Terminate TLS at nginx by adding a listen 443 ssl; block with your real certificate, and use return 301 https://$host$request_uri; on :80.
• Sample traces. If your application throughput is high, edit /etc/jaeger/config.yaml to add a probabilistic sampler under processors:, for example 1% sampling in production.
• Monitor Jaeger metrics. The config exposes Prometheus metrics on :8888. Scrape them from your Prometheus install to watch receiver throughput, exporter latency and dropped spans.
• Patch monthly. Run apt-get update && apt-get upgrade && reboot, and subscribe to https://github.com/jaegertracing/jaeger/releases for Jaeger releases.