Akvorado on Ubuntu 24.04 on Azure User Guide

Overview

This image runs Akvorado 2.4.1, the open source network flow collector, enricher and visualizer, on Ubuntu 24.04 LTS. Akvorado receives network flows exported by your routers and switches over NetFlow, IPFIX and sFlow, enriches each flow with metadata such as source and destination AS number, BGP routing information and interface names, stores the result in a ClickHouse database, and lets you explore it interactively in a web console, breaking traffic down by protocol, port, AS, country, exporter and interface.

The image ships the stock upstream Akvorado image run with Docker Compose under a systemd service that starts it on boot. The stack is a memory tuned deployment of the akvorado collector, enricher and console together with a ClickHouse flow store, an Apache Kafka buffer and a Valkey cache, all on a single VM behind an nginx front door on port 80. Every image is pinned by tag and baked into the VM image, so nothing is pulled on first boot.

What is included:

• Akvorado 2.4.1 (stock upstream quay.io/akvorado/akvorado image, pinned), run by systemd via Docker Compose
• The Akvorado web console on :80, fronted by nginx with a per-VM HTTP Basic password
• A bundled ClickHouse flow store, Apache Kafka buffer and Valkey cache, all on the same VM
• Flow ingestion for NetFlow on UDP 2055, IPFIX on UDP 4739 and sFlow on UDP 6343
• No baked-in login: Akvorado's console has no built-in authentication, so cloudimg fronts it with a unique password generated on this VM's first boot
• docker.service, nginx.service, akvorado-firstboot.service and akvorado.service as enabled systemd units
• A fully patched Ubuntu 24.04 LTS base with unattended security upgrades enabled

Akvorado is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). This image ships stock, unmodified upstream Akvorado; the corresponding source for the network hosted console is the pinned upstream release at github.com/akvorado/akvorado (tag v2.4.1).

Prerequisites

• An Azure subscription and a resource group.
• An SSH key pair for administrative access to the VM.
• A network security group (NSG) that allows:
• TCP 22 for SSH (lock this down to your admin IP).
• TCP 80 for the web console (front it with your own TLS or an SSO proxy for production).
• UDP 2055, 4739 and 6343 from the routers and switches that will export flows.
• Recommended size: Standard_B2s (2 vCPU, 4 GiB) to start. Akvorado scales with flow volume, so choose a larger size for busy collectors.

Launch the VM

From the Azure Marketplace (portal)

1. Open the Akvorado on Ubuntu 24.04 LTS by cloudimg offer and select Get it now, then Create.
2. Choose your subscription, resource group and region.
3. Pick a VM size (Standard_B2s to start) and provide your SSH public key.
4. On the Networking tab, attach an NSG that allows TCP 22 and 80 and UDP 2055, 4739 and 6343 as above.
5. Review and create. When deployment finishes, note the VM's public IP address.

From the Azure CLI

az vm create \
  --resource-group my-rg \
  --name akvorado \
  --image cloudimg:akvorado-ubuntu-24-04:akvorado-ubuntu-24-04:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

# Open the console and the flow ingestion ports
az vm open-port --resource-group my-rg --name akvorado --port 80 --priority 900
az vm open-port --resource-group my-rg --name akvorado --port 2055 --priority 910

The flow ports (UDP 2055 / 4739 / 6343) can be added as additional NSG rules; open only the protocols your exporters use.

Retrieve the per-VM console password

Akvorado's web console has no built-in login. cloudimg fronts it with nginx HTTP Basic authentication using a password generated uniquely on this VM's first boot and written to a root only file. SSH in and read it:

sudo cat /root/akvorado-credentials.txt

You will see the console URL, the username (admin) and the generated password:

AKVORADO_URL=http://<your-vm-ip>/
AKVORADO_CONSOLE_USER=admin
AKVORADO_CONSOLE_PASSWORD=<AKVORADO_CONSOLE_PASSWORD>

Confirm the stack is healthy

The whole stack runs as a Docker Compose deployment managed by akvorado.service. Check the systemd units and the containers:

systemctl is-active docker.service nginx.service akvorado-firstboot.service akvorado.service
cd /opt/akvorado && sudo docker compose ps

All seven containers should report Up ... (healthy):

akvorado-console       Up (healthy)
akvorado-inlet         Up (healthy)
akvorado-orchestrator  Up (healthy)
akvorado-outlet        Up (healthy)
clickhouse             Up (healthy)
kafka                  Up (healthy)
redis                  Up (healthy)

The console front door answers on port 80. An unauthenticated health probe returns 200, and the console itself requires the per-VM password:

PW=$(sudo grep '^AKVORADO_CONSOLE_PASSWORD=' /root/akvorado-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'health=%{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'no-auth=%{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'auth=%{http_code}\n' -u "admin:$PW" http://127.0.0.1/

health=200
no-auth=401
auth=200

Sign in to the console

Open http://<your-vm-ip>/ in a browser. Your browser will prompt for a username and password: enter admin and the password from the credentials file. The Akvorado console then loads on the Home page, which summarises recent traffic: the flow rate, the exporters seen, the top source AS numbers, ports, protocols and countries, and the fully enriched details of the last flow received. Until you point exporters at the VM there will be no data yet.

Send flows to Akvorado

Configure your routers, switches or firewalls to export flow records to this VM's IP address on the matching UDP port:

For example, on a device that exports NetFlow v9, set the collector to <your-vm-ip>:2055. Akvorado's inlet receives the packets, the outlet enriches and writes them to ClickHouse, and they become visible in the console within seconds. Optionally peer BMP on TCP 10179 to enrich flows with BGP routing information.

Explore traffic in the console

Once flows arrive, the console's Visualize page lets you build interactive graphs. Pick a dimension (for example source AS, destination port, protocol or exporter interface) and a time range, and Akvorado renders a stacked time series or a Sankey diagram of your traffic.

The same query can be rendered as line series per source AS, or as a Sankey diagram to see how traffic flows between source and destination autonomous systems.

Verify flows are stored (optional)

Flows are stored in the ClickHouse flows table. You can confirm ingestion directly:

cd /opt/akvorado
sudo docker compose exec -T clickhouse clickhouse-client -q "SELECT count() FROM flows"
sudo docker compose exec -T clickhouse clickhouse-client -q \
  "SELECT SrcAS, count() AS c, sum(Bytes) AS bytes FROM flows GROUP BY SrcAS ORDER BY c DESC LIMIT 5 FORMAT PrettyCompact"

The count grows as flows arrive, and the grouped query shows the busiest source AS numbers:

Security and production hardening

• Change nothing to rotate the password on a fresh VM: each VM generates its own console password on first boot. To rotate it yourself, run sudo htpasswd -B /etc/nginx/akvorado.htpasswd admin and reload nginx.
• Terminate TLS. The console is served over plain HTTP on port 80. For production, front the VM with your own TLS (for example an Azure Application Gateway or a reverse proxy with a certificate) or restrict port 80 to a management network.
• Use real SSO for teams. Akvorado authorises users from a Remote-User header supplied by a front proxy. The nginx front door here supplies that behind a single shared password; for multi user access, place an SSO proxy (Authelia, Authentik, Keycloak or oauth2-proxy) in front and have it set Remote-User.
• Restrict the flow ports. Only open UDP 2055 / 4739 / 6343 to the exporters that need them.
• The base image keeps unattended security upgrades enabled.

How the appliance is built

• The stack is defined in /opt/akvorado/docker-compose.yaml with configuration under /opt/akvorado/config.
• akvorado-firstboot.service generates the per-VM console password on first boot, writes the nginx htpasswd and the credentials file, and brings the stack up. It runs once, guarded by a sentinel at /var/lib/cloudimg/akvorado-firstboot.done.
• akvorado.service keeps the stack running on every subsequent boot.
• akvorado-swap.service adds swap on the ephemeral resource disk at boot so the memory heavy stack runs comfortably on small VMs. No swap is baked into the image.

Licensing

Akvorado is free software under the GNU Affero General Public License v3.0 (AGPL-3.0). Because the console is served over a network, the AGPL requires that its complete corresponding source be offered to users; that source is the pinned upstream release used by this image, available at github.com/akvorado/akvorado, tag v2.4.1. cloudimg ships stock, unmodified upstream Akvorado and provides only external configuration (the compose file, configuration files, systemd units and the nginx front door). The cloudimg charge of $0.04 per vCPU hour covers packaging, security patching, image maintenance and 24/7 support.

Support

cloudimg provides 24/7 support for this image. If you have any questions about deploying or operating Akvorado on Azure, contact us at support@cloudimg.co.uk.