SecureAnyCloud
Deployment guide

VictoriaMetrics

Overview

VictoriaMetrics is a fast, cost-effective and scalable open-source time-series database and monitoring solution. It is a drop-in Prometheus replacement for long-term metrics storage. It speaks PromQL and the extended MetricsQL, ingests via Prometheus remote-write, InfluxDB, Graphite and OpenTSDB protocols, and uses a fraction of the RAM and disk of comparable systems.

The SecureAnyCloud image installs VictoriaMetrics single-node 1.145.0 at /opt/victoriametrics and runs it as a dedicated victoriametrics system user. It binds VictoriaMetrics to loopback behind an nginx reverse proxy on TCP 80 with HTTP Basic auth, and it persists all time-series data on a dedicated Azure data disk. A unique web password is generated on the first boot of every VM.

The image also self-scrapes its own metrics, so the database is useful the moment it boots. It is backed by 24/7 SecureAnyCloud support.

What you get:

  • VictoriaMetrics single-node 1.145.0 at /opt/victoriametrics
  • The vmui web UI and the Prometheus-compatible query and ingest API, fronted by nginx on :80
  • nginx HTTP Basic auth (VictoriaMetrics single-node has no built-in authentication) with a per-VM password in a root-only file
  • A dedicated Azure data disk at /var/lib/victoria-metrics holding all time-series data, separate from the OS disk and re-provisioned with every VM
  • Built-in self-monitoring (-selfScrapeInterval) so the database has live metrics from first boot
  • victoriametrics.service and nginx.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

Before you deploy this image you need:

  • An active Azure subscription
  • An SSH key pair
  • A virtual network and subnet in the target region
  • A network security group that allows inbound 22/tcp from your management network and 80/tcp for the web UI and API. Front the web UI with TLS for public exposure (see Enabling HTTPS).

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. Scale up for higher ingestion rates and cardinality.

Step 1 - Deploy from the Azure Marketplace

  1. Sign in to the Azure Portal, choose Create a resource, search the Marketplace for VictoriaMetrics by SecureAnyCloud, and select Create.
  2. On Basics, pick your subscription, resource group, region and size.
  3. Under Administrator account, choose SSH public key and paste your key.
  4. Under Inbound port rules, allow SSH (22) and HTTP (80).
  5. Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms, create the VM, and open port 80. Replace the values in angle brackets with your own:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:victoriametrics-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name victoriametrics \
  --image sac1647283583153:victoriametrics-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name victoriametrics --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as the administrator user you configured:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active:

systemctl is-active victoriametrics.service nginx.service

Both services report active. VictoriaMetrics starts in seconds and begins self-scraping its own metrics immediately.

Step 5 - Retrieve your web password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file. Read it as root:

sudo cat /root/victoriametrics-credentials.txt

The file contains VICTORIAMETRICS_ADMIN_USER (admin) and VICTORIAMETRICS_ADMIN_PASSWORD, plus the URLs for the web UI and API. Store the password somewhere safe.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Query it:

curl -s http://localhost/health

It returns ok.

Step 7 - Open the vmui web UI

Browse to http://<vm-public-ip>/vmui/ and sign in as admin with the password from Step 5.

vmui is the built-in query interface. Enter a PromQL or MetricsQL expression and run it as a graph, JSON or table. The image self-scrapes its own internals, so you can immediately graph metrics such as process_resident_memory_bytes or vm_rows.

The Table tab shows the instant value of each series returned by your query.

The Cardinality tool under Explore helps you find which metrics and label values consume the most storage.

Step 8 - Query from the command line

The Prometheus-compatible query API is available behind the same Basic auth. Confirm that VictoriaMetrics is serving and report its build version:

curl -s -u admin:<VICTORIAMETRICS_ADMIN_PASSWORD> 'http://localhost/api/v1/query?query=vm_app_version' | head -c 300; echo

You get a JSON response with "status":"success" and a vm_app_version series carrying the running version label.

Step 9 - Ingest your own metrics

VictoriaMetrics accepts Prometheus remote-write at /api/v1/write and also a simple line-import endpoint.

Push a sample data point with the Prometheus import API. It is accepted immediately and becomes queryable within a few seconds. Then query the total number of active time series the database is tracking:

printf 'example_metric{source="guide"} 42\n' | curl -s -u admin:<VICTORIAMETRICS_ADMIN_PASSWORD> -H 'Content-Type: text/plain' --data-binary @- http://localhost/api/v1/import/prometheus curl -s -u admin:<VICTORIAMETRICS_ADMIN_PASSWORD> 'http://localhost/api/v1/query?query=count(%7B__name__!=%22%22%7D)' | head -c 300; echo

The count query returns a "status":"success" response with the number of active series, which the image's built-in self-monitoring has already populated.

To ship real metrics, point Prometheus, Telegraf, Grafana Agent or any remote-write client at http://<vm-public-ip>/api/v1/write with the Basic-auth credentials. To visualize them, add VictoriaMetrics as a Prometheus data source in Grafana using the same URL.

Step 10 - Confirm data lives on the dedicated disk

All time-series data is stored on the dedicated Azure data disk, so it survives OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/victoria-metrics

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it.

The simplest option is to add a DNS name for the VM and use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy. Alternatively, install certbot and extend the existing nginx site with a listen 443 ssl; server block and your certificate paths.

Keep VictoriaMetrics itself bound to loopback, so the only public surface is the authenticated, TLS-terminated proxy.

Maintenance

  • Retention: the image keeps 12 months of data by default (-retentionPeriod=12). Adjust it in /etc/default/victoriametrics (the VM_ARGS line) and run sudo systemctl restart victoriametrics.
  • Backups: snapshot the /var/lib/victoria-metrics data disk, or use vmbackup for incremental backups to Azure Blob Storage.
  • Upgrades: replace the /opt/victoriametrics/victoria-metrics-prod binary with a newer release and restart the service. The on-disk data format is forward-compatible.
  • Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch VictoriaMetrics on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure