perfSONAR on Alma 9

In the Azure Portal, open Marketplace, search for perfSONAR Toolkit AlmaLinux, and select the SecureAnyCloud publisher entry. Click Create.

On the Basics tab, choose your subscription, target resource group and region, and set the virtual machine name. Choose SSH public key as the authentication type, set the username to azureuser, and paste your SSH public key.

Standard_B2ms (2 vCPU, 8 GiB) is the recommended minimum size. The toolkit runs OpenSearch and Logstash (both JVM based) alongside Grafana and PostgreSQL, and 4 GiB is too tight. For a busy measurement point that archives results from many test partners, Standard_B4ms (4 vCPU, 16 GiB) or larger is a better starting point.

On the Disks tab, select Standard SSD for the OS disk.

On the Networking tab, select your existing virtual network and subnet. Attach a network security group that opens TCP 22 from your management IP range and TCP 443 from the client IPs that need dashboard access. To run measurements, also open the measurement ports in Step 13 to and from your test partners.

On the Management, Monitoring and Advanced tabs, the defaults are appropriate. Click Review + create, wait for validation to pass, then click Create.

Deployment takes around two to three minutes. The first boot then runs the credential-provisioning service, which takes a few minutes more before the dashboard becomes reachable.

To deploy from the command line, accept the Marketplace terms once, then create the VM from the Marketplace image URN:

RG="perfsonar-prod" LOCATION="eastus" VM_NAME="perfsonar-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:perfsonar:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:perfsonar:default:latest
az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2ms \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard

Afterwards, open the required ports on the network security group with az network nsg rule create. Open TCP 22 and 443 at a minimum.

Log in to the administrative account with the SSH key you supplied at deployment:

ssh azureuser@<your-vm-public-ip>

The message of the day points you to the credentials file and to this guide.

On first boot, the provisioning service writes a per-VM credentials file that only root can read. Read it over SSH:

sudo cat /root/perfsonar-credentials.txt

The file contains the public dashboard URL, the Grafana administrator login and the Toolkit administration console login. These values are unique to this virtual machine.

The OpenSearch measurement archive is localhost-only and needs no action from you. Its credentials are regenerated automatically for each VM.

perfSONAR is a collection of coordinated services. Confirm that pScheduler is alive and the core daemons are active:

pscheduler ping localhost systemctl is-active httpd opensearch pscheduler-scheduler owamp-server grafana-server

The pScheduler is alive message confirms that the scheduler API is answering. Every listed unit should report active.

pScheduler is the front end to every measurement. The simplest test is a round-trip-time (ping) measurement. Run it against the loopback to confirm the measurement pipeline end to end:

pscheduler task rtt --dest 127.0.0.1 --count 3

To measure against a real remote perfSONAR host, replace the destination. A throughput test needs a perfSONAR host at the other end, because throughput has two participants and cannot run against the loopback:

pscheduler task rtt --dest <remote-perfsonar-host> pscheduler task throughput --dest <remote-perfsonar-host> pscheduler task latency --dest <remote-perfsonar-host>

Valid destinations include public perfSONAR hosts published in the global lookup service, and another virtual machine launched from this same image.

Open https://<your-vm-public-ip>/ in a browser. The root of the virtual machine redirects to the perfSONAR dashboard. Grafana serves the dashboards, and the public views are read-only and need no login.

The Grafana administrator login, which you need to edit dashboards and data sources, is in the credentials file from Step 4:

The perfSONAR Host Metrics dashboard shows live host and service health immediately. It includes the service up/down history, the current status of every perfSONAR component, and the installed bundle and version.

The perfSONAR Main dashboard is where measurement results appear once regular tests are configured. On a freshly launched node with no test partners yet, the test panels read No data. This is expected. Configure regular tests (Step 8) and the panels populate.

Ad-hoc pscheduler task runs are one-off. To build a continuous record that fills the dashboards, define regular tests with pSConfig or through the Toolkit administration console. A regular test is a schedule between this host and one or more remote perfSONAR hosts, for example RTT every minute and throughput every hour.

To use the browser, open the Toolkit administration console at https://<your-vm-public-ip>/toolkit/. Sign in with the toolkit_admin credentials from Step 4, then use the Configuration menu to add test partners and schedules. Alternatively, use psconfig on the command line to apply a JSON test template.

Give each test a remote perfSONAR host as the partner. Results flow into the local archive and appear on the perfSONAR Main dashboard.

Measurement results are stored in a local OpenSearch archive. It binds to 127.0.0.1 only and is fronted by Grafana, so you never expose it directly.

The archive credentials are regenerated uniquely on each virtual machine's first boot and need no manual handling. Grafana reads the archive through an authenticated reverse proxy, and the dashboards you saw in Step 7 are backed by it.

The Toolkit administration console (/toolkit/) is password protected by a per-VM account created on first boot. Sign in with the toolkit_admin.user and toolkit_admin.password values from the credentials file.

From the console you can set host administrative information, manage regular tests, adjust pScheduler limits and review logs.

Confirm the installed toolkit version, its license and the web health endpoint:

rpm -q perfsonar-toolkit perfsonar-core rpm -qi perfsonar-core | grep License curl -sk https://localhost/grafana/api/health

The image is patched at build time. Apply AlmaLinux security updates with dnf:

sudo dnf -y upgrade --refresh

perfSONAR itself updates from its official repository as new toolkit releases land:

sudo dnf -y upgrade 'perfsonar-*'

perfSONAR's measurement daemons need specific ports open to and from your test partners. The image's firewall (configured by perfsonar-toolkit-security) already opens them locally. Mirror the equivalents on your Azure network security group for the partners you test against:

• TCP 22: SSH administration
• TCP 443: the perfSONAR dashboard and Toolkit console (HTTPS)
• TCP/UDP 861: owamp control and one-way latency
• TCP/UDP 862: twamp control and two-way latency
• TCP/UDP 5201, 5001, 5101, and the 8760-9960 range: throughput tools (iperf3, nuttcp) and owamp/twamp test ports

Restrict each rule to the specific partner hosts and management IPs. Do not open the dashboard to the entire public internet.

• Restrict the dashboard. Keep TCP 443 open only to the client IPs that need it. The public dashboard views are read-only, but there is no reason to expose them broadly.
• Rotate the web passwords if you wish. The first-boot passwords are unique per VM. You can change the Grafana administrator password in the Grafana UI, and manage the Toolkit administration account with the perfSONAR manage_users tooling.
• Use a real certificate. The image serves HTTPS with a self-signed certificate. For a named host, install a CA-issued certificate into Apache's TLS configuration.
• Scope your measurement ports. Open owamp/twamp/throughput ports only to your intended perfSONAR partners, never to 0.0.0.0/0.
• Keep the system patched. Apply AlmaLinux and perfSONAR updates on a schedule (Step 12).