VictoriaLogs 1.53.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick VictoriaLogs 1.53.0 on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2.

Choose m5.large, your key pair and a security group as described above. The AMI brings its own 32 GiB data volume for the logs. If you expect more log data, increase its size on the launch page (see Step 9).

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=victorialogs}]'

Connect over SSH as the ubuntu user with the key pair you launched with.

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate and the password, then nginx starts in front of VictoriaLogs. Confirm that all three services are active and first boot has finished.

systemctl is-active victorialogs nginx victorialogs-firstboot
sudo test -f /var/lib/sac/data/victorialogs-firstboot.done && echo FIRSTBOOT_DONE /usr/local/bin/victoria-logs-prod -version

active active active FIRSTBOOT_DONE victoria-logs-20261001-105650-tags-v1.53.0-0-g915d91904b

The binary was compiled from the v1.53.0 source with Go 1.27.3. The build provenance file records the source archive and its tag commit, the toolchain, the exact build command, the binary's checksum and the govulncheck result. It sits next to the Apache-2.0 licence.

sha256sum /usr/local/bin/victoria-logs-prod grep -E '^(source |tag commit|toolchain |binary sha256|govulncheck)' /usr/share/doc/victorialogs/BUILD-PROVENANCE.txt head -3 /usr/share/doc/victorialogs/LICENSE | sed '/^\s*$/d'

b2d92f78d547853461388ff421c3fc2e860cbcd541c0d5f1f465d84714770ee3 /usr/local/bin/victoria-logs-prod source https://github.com/VictoriaMetrics/VictoriaLogs/archive/refs/tags/v1.53.0.tar.gz source sha256 9dab43bfb2ccc2b3009a2e7cacd798f12b561a92f4a29c8a697c60295a383874 tag commit 915d91904bf7f5be66ab00f88947ae7fc1431acc toolchain go1.27.3 linux/amd64, official tarball https://go.dev/dl/go1.27.3.linux-amd64.tar.gz binary sha256 b2d92f78d547853461388ff421c3fc2e860cbcd541c0d5f1f465d84714770ee3 (reproducible: an independent out-of-band build of the same inputs gives the same bytes) govulncheck v1.9.0, source: No vulnerabilities found.; binary: No vulnerabilities found. Apache License Version 2.0, January 2004 http://www.apache.org/licenses/

Only SSH and nginx listen on public addresses. VictoriaLogs listens on loopback.

sudo ss -Hlntp | awk '{print $4, $6}' | grep -v '127.0.0.5' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort

0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:9428 users:(("victoria-logs-p")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx"))

The URLs and the user name are in the root-only credentials file.

sudo grep -E '^victorialogs\.(url|ingest_url|username)=' /root/victorialogs-credentials.txt

victorialogs.url=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/select/vmui/ victorialogs.ingest_url=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/insert/jsonline victorialogs.username=admin

The password is the victorialogs.password line of the same file: sudo grep '^victorialogs.password=' /root/victorialogs-credentials.txt. It is unique to this instance, so store it in your password manager or secrets store.

The URL uses the instance's public DNS name from EC2 instance metadata (IMDSv2). If the instance has no public name, it uses the public or private IPv4 address. The certificate names that host plus the instance's public and private IP addresses, so browsers and agents can use any of them.

openssl x509 -in /etc/ssl/victorialogs/victorialogs.crt -noout -subject -ext subjectAltName -enddate

subject=CN = ec2-<public-ip-dashed>.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.compute-1.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost notAfter=<date about 27 months after first boot>

Without the password, every path is refused. A wrong password is refused, and port 80 redirects to HTTPS. With the password, the web UI answers. /healthz answers without a login, for load balancer health checks.

The commands below read the password from the credentials file into a shell variable and pass it to curl through a file descriptor. The password never appears in the process list or your shell history.

H=$(sudo sed -n 's#^victorialogs\.url=https://\([^/]*\)/.*#\1#p' /root/victorialogs-credentials.txt)
PW=$(sudo sed -n 's/^victorialogs\.password=//p' /root/victorialogs-credentials.txt) CA=/etc/ssl/victorialogs/victorialogs.crt curl -s -o /dev/null -w 'http:// -> %{http_code} %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/select/vmui/" curl -s -o /dev/null -w 'no login -> HTTP %{http_code}\n' --cacert $CA --resolve "$H:443:127.0.0.1" "https://$H/select/vmui/" curl -s -o /dev/null -w 'wrong password -> HTTP %{http_code}\n' --cacert $CA --resolve "$H:443:127.0.0.1" -u admin:not-the-password "https://$H/select/vmui/" curl -s -o /dev/null -w 'admin + password -> HTTP %{http_code}\n' --cacert $CA --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") "https://$H/select/vmui/" curl -s -w ' <- /healthz (no login) HTTP %{http_code}\n' --cacert $CA --resolve "$H:443:127.0.0.1" "https://$H/healthz"

http:// -> 301 https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/select/vmui/ no login -> HTTP 401 wrong password -> HTTP 401 admin + password -> HTTP 200 ok <- /healthz (no login) HTTP 200

--resolve sends the request to this instance while keeping the real host name, so the certificate check passes. From another machine, drop --resolve and use the URL directly.

The JSON lines API takes one JSON object per line. The query string names the field that holds the message (_msg_field), the timestamp field (_time_field, where 0 means now) and the fields that identify a log stream (_stream_fields).

Send twelve sample lines, then query them back.

H=$(sudo sed -n 's#^victorialogs\.url=https://\([^/]*\)/.*#\1#p' /root/victorialogs-credentials.txt)
PW=$(sudo sed -n 's/^victorialogs\.password=//p' /root/victorialogs-credentials.txt) CA=/etc/ssl/victorialogs/victorialogs.crt for svc in web-01 web-02 db-01; do for lvl in info info warn error; do printf '{"_msg":"%s request handled on %s","_time":"0","service":"checkout","host":"%s","level":"%s"}\n' "$lvl" "$svc" "$svc" "$lvl" done done | curl -s -o /dev/null -w 'ingest -> HTTP %{http_code}\n' --cacert $CA --resolve "$H:443:127.0.0.1" \
  -K <(printf 'user = "admin:%s"\n' "$PW") -H 'Content-Type: application/stream+json' --data-binary @- \
  "https://$H/insert/jsonline?_stream_fields=service,host&_time_field=_time&_msg_field=_msg" sleep 2 curl -s --cacert $CA --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") \
  --data-urlencode 'query=level:error | fields host, level, _msg | sort by (host)' \
  "https://$H/select/logsql/query" curl -s --cacert $CA --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") \
  --data-urlencode 'query=service:checkout | stats by (level) count() as lines | sort by (level)' \
  "https://$H/select/logsql/query"

ingest -> HTTP 200 {"host":"db-01","level":"error","_msg":"error request handled on db-01"} {"host":"web-01","level":"error","_msg":"error request handled on web-01"} {"host":"web-02","level":"error","_msg":"error request handled on web-02"} {"level":"error","lines":"3"} {"level":"info","lines":"6"} {"level":"warn","lines":"3"}

The first query filters on a field and picks the fields to return. The second counts lines per level with the stats pipe. The LogsQL documentation lists every filter and pipe.

VictoriaLogs also accepts the Loki push API, so agents already configured for Grafana Loki can send here unchanged.

H=$(sudo sed -n 's#^victorialogs\.url=https://\([^/]*\)/.*#\1#p' /root/victorialogs-credentials.txt)
PW=$(sudo sed -n 's/^victorialogs\.password=//p' /root/victorialogs-credentials.txt) CA=/etc/ssl/victorialogs/victorialogs.crt
TS=$(date +%s%N)
curl -s -o /dev/null -w 'loki push -> HTTP %{http_code}\n' --cacert $CA --resolve "$H:443:127.0.0.1" \
  -K <(printf 'user = "admin:%s"\n' "$PW") -H 'Content-Type: application/json' \
  -d "{\"streams\":[{\"stream\":{\"job\":\"guide-test\"},\"values\":[[\"$TS\",\"hello from the Loki push API\"]]}]}" \
  "https://$H/insert/loki/api/v1/push" sleep 2
curl -s --cacert $CA --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") \
  --data-urlencode 'query=job:guide-test | fields job, _msg' "https://$H/select/logsql/query"

loki push -> HTTP 204 {"job":"guide-test","_msg":"hello from the Loki push API"}

Open the victorialogs.url from Step 4 (https://<your-host>/select/vmui/) in a browser. The certificate is self-signed, so the browser warns once. Accept it, or install your own certificate (Step 10). Sign in as admin with the password from the credentials file.

Type a LogsQL query, for example service:checkout, choose a time range and press Execute. The hits histogram shows when the lines arrived. The Stream fields panel lists the fields that identify your log streams, and the results are grouped by stream with color-coded levels.

Narrow the search with a filter such as level:error.

The Table tab shows each line as a row with one column per field, and JSON shows the raw records.

The Overview page summarizes everything stored: total lines, ingestion rate, the number of log streams, and the fields with how many lines carry each one.

Any agent that speaks one of the supported APIs works. Give it the URL, the user admin, the password and the instance's certificate, so it can verify the connection. Copy the certificate to each agent host first. It is public, not a secret.

scp -i <your-key.pem> ubuntu@<victorialogs-host>:/etc/ssl/victorialogs/victorialogs.crt ./victorialogs.crt

Fluent Bit ([OUTPUT] section), sending JSON lines:

[OUTPUT] Name http Match * Host <victorialogs-host> Port 443 URI /insert/jsonline?_stream_fields=stream,host&_msg_field=log&_time_field=date Format json_lines Json_date_format iso8601 tls On tls.verify On tls.ca_file /etc/fluent-bit/victorialogs.crt http_User admin http_Passwd <VICTORIALOGS_PASSWORD>

Vector (vector.yaml), using the Elasticsearch-compatible API:

sinks: victorialogs: type: elasticsearch inputs: [your_source] endpoints: ["https://<victorialogs-host>/insert/elasticsearch/"] api_version: v8 compression: gzip healthcheck: enabled: false auth: strategy: basic user: admin password: <VICTORIALOGS_PASSWORD> tls: ca_file: /etc/vector/victorialogs.crt query: _msg_field: message _time_field: timestamp _stream_fields: host,container_name

Grafana Alloy, Promtail or any Loki client: use https://<victorialogs-host>/insert/loki/api/v1/push as the push URL with basic auth admin and the password. OpenTelemetry Collector: use an otlphttp exporter with logs_endpoint: https://<victorialogs-host>/insert/opentelemetry/v1/logs and a basicauth extension.

Keep the password in the agent's own secret store or a root-only file, not in a world-readable configuration. Agents send no browser Origin header, so the image's cross-site request guard does not affect them.

Syslog (optional). The syslog receiver is off because syslog has no authentication. To receive syslog from hosts in your own network, take these steps:

• Add -syslog.listenAddr.tcp=:514 to the ExecStart line of /etc/systemd/system/victorialogs.service.
• Run sudo systemctl daemon-reload && sudo systemctl restart victorialogs.
• Open TCP 514 in the security group only to your VPC or VPN CIDRs, never to 0.0.0.0/0.

Senders then use the instance's private IP address.

VictoriaLogs keeps all log data on the dedicated EBS volume mounted at /var/lib/victoria-logs. Check its usage and the service settings.

sudo du -sh /var/lib/victoria-logs df -h /var/lib/victoria-logs | tail -1 | awk '{print $2" total, "$4" free on "$6}' systemctl cat victorialogs | grep -E '^\s+-'

156K /var/lib/victoria-logs 32G total, 30G free on /var/lib/victoria-logs -httpListenAddr=127.0.0.1:9428 \
  -storageDataPath=/var/lib/victoria-logs \
  -retentionPeriod=30d \
  -loggerTimezone=UTC

Logs older than the retention period (30 days) are deleted automatically. To keep them longer, change -retentionPeriod in /etc/systemd/system/victorialogs.service, for example to -retentionPeriod=90d or -retentionPeriod=1y. Then run sudo systemctl daemon-reload && sudo systemctl restart victorialogs. You can also cap the disk space with -retention.maxDiskSpaceUsageBytes.

To grow the volume, modify it in the EC2 console (Volumes, Modify volume). Then extend the file system online.

sudo resize2fs "$(findmnt -no SOURCE /var/lib/victoria-logs)"

For backups, take EBS snapshots of the data volume.

The served host name is fixed by configuration and never taken from a request. To serve VictoriaLogs under your own DNS name, point the name at the instance and run the helper. The helper records the name, regenerates the self-signed certificate for it, updates the credentials file and reloads nginx.

sudo victorialogs-set-hostname <your-dns-name>

If the instance's public DNS name changes after a stop and start, run the same command again, because a request for a name the instance does not serve is dropped. An Elastic IP avoids this.

To use a certificate from your own CA or a public CA instead, replace /etc/ssl/victorialogs/victorialogs.crt (full chain) and /etc/ssl/victorialogs/victorialogs.key (mode 0600, owner root). Then run sudo nginx -t && sudo systemctl reload nginx.

Alternatively, put the instance behind an Application Load Balancer with an AWS Certificate Manager certificate. Let the load balancer forward to port 443, with /healthz as the health check path.

VictoriaLogs runs as its own unprivileged user with a read-only system, and it cannot reach the instance metadata endpoint.

systemctl show victorialogs -p User -p NoNewPrivileges -p ProtectSystem -p ProtectHome -p IPAddressDeny

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 User=victorialogs ProtectHome=yes ProtectSystem=full NoNewPrivileges=yes

SSH accepts keys only. Passwords, root logins and X11 forwarding are switched off in /etc/ssh/sshd_config.d/00-sac.conf, which sorts before every other SSH setting. Check the effective values.

sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin|x11forwarding|pubkeyauthentication) '

permitrootlogin no pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no x11forwarding no

A state-changing request that carries a foreign browser Origin is refused, even with the right password. A web page therefore cannot write to or delete from VictoriaLogs through a signed-in browser.

H=$(sudo sed -n 's#^victorialogs\.url=https://\([^/]*\)/.*#\1#p' /root/victorialogs-credentials.txt)
PW=$(sudo sed -n 's/^victorialogs\.password=//p' /root/victorialogs-credentials.txt) CA=/etc/ssl/victorialogs/victorialogs.crt curl -s -o /dev/null -w 'Origin evil.example ingest -> HTTP %{http_code}\n' --cacert $CA --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") -H 'Origin: https://evil.example' -H 'Content-Type: application/json' -d '{"_msg":"x"}' "https://$H/insert/jsonline"

Origin evil.example ingest -> HTTP 403

Keep these points in mind:

• VictoriaLogs has a single account. Anyone with the password can ingest, read and delete every log stream. Give each team its own instance if they must not see each other's logs.
• nginx logs the real client address of every request and ignores X-Forwarded-For headers sent by clients.
• SSH accepts key logins as ubuntu only, with no passwords, no root login and no X11 forwarding. Use sudo for administration.
• The VictoriaLogs service is denied the instance metadata endpoint (IPAddressDeny in /etc/systemd/system/victorialogs.service.d/50-sac-imds-deny.conf), and it fetches no remote URLs.
• The AMI requires IMDSv2. Restrict port 443 to the networks your users and agents use, and never open 9428.
• To rotate the password, generate a new one and write its bcrypt hash with sudo htpasswd -iB /etc/nginx/.victorialogs.htpasswd admin, which reads the new password from standard input. Then update /root/victorialogs-credentials.txt, reload nginx and update your agents.