openITCOCKPIT Community Edition on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of openITCOCKPIT Community Edition on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. openITCOCKPIT is an open source monitoring platform built around the Naemon monitoring core with Statusengine for check result processing and a modern CakePHP and Angular web interface for hosts, services, dashboards, maps, graphs and notifications. openITCOCKPIT Community Edition is licensed under the GNU General Public License version 3.

The image installs openITCOCKPIT 5.6.1 from the official openITCOCKPIT apt repository. The full native stack runs as systemd services, nginx on ports 80 and 443, PHP 8.3 FPM, MySQL 8.0, Redis, the Gearman job server, the Naemon monitoring engine, the mod-gearman check runner and the Statusengine worker, alongside the openITCOCKPIT graphing subsystem (Grafana, Graphite and VictoriaMetrics) and the reporting node running under Docker on the same host. At first boot openitcockpit-ce-firstboot.service generates a unique per instance admin password, MySQL password, websocket API key, mod-gearman secret, CakePHP security salt and Grafana password, and writes the admin and database credentials to /root/openitcockpit-ce-credentials.txt (mode 0600, root only). There is no default or shared login baked into the image.

What is included:

• openITCOCKPIT Community Edition 5.6.1 installed from the official apt repository, with the Naemon monitoring core, mod-gearman check runner and Statusengine worker

• A working default configuration out of the box: the server monitors itself (host default host at 127.0.0.1) with four services (Ping, disk usage, system load and Statusengine performance) so you can watch real monitoring the moment the instance is up

• The full CakePHP and Angular web UI on nginx (port 80 redirecting to 443 with a self signed certificate) for hosts, services, dashboards, maps, graphs, users and configuration

• openitcockpit-ce-firstboot.service systemd oneshot that rotates every secret per instance, resolves the instance address and writes /root/openitcockpit-ce-credentials.txt

• The graphing subsystem (Grafana, Graphite, VictoriaMetrics) and the Puppeteer report node, bound to loopback and reached only through the authenticated nginx proxy

• MySQL root secured with auth_socket (no password shipped) and every monitoring engine socket bound to loopback

• Ubuntu 24.04 LTS base with the latest security patches and an 8 GB swap file provisioned at first boot

• Azure Linux Agent for seamless cloud integration and SSH key injection

• 24/7 cloudimg support with guaranteed 24 hour response SLA

Prerequisites

• An active Azure subscription, an SSH public key, and a VNet plus subnet in the target region

• A subscription to the openITCOCKPIT Community Edition on Ubuntu 24.04 listing on Azure Marketplace

• A network security group that allows inbound TCP 22 (SSH), 80 and 443 (web UI) from your administrative network

Recommended virtual machine size: Standard_D2s_v3 (2 vCPU, 8 GB RAM) or larger. openITCOCKPIT is a multi service platform (monitoring core, database, web stack and the graphing containers), so it wants more memory than a single application. The image runs comfortably on 8 GB and an 8 GB swap file is added automatically at first boot; increase the size as you add hosts and services to monitor.

Step 1: Deploy from the Azure Portal

1. Open the openITCOCKPIT Community Edition on Ubuntu 24.04 listing and select Get It Now, then Create.
2. Choose your subscription, resource group and region.
3. Set the VM size to Standard_D2s_v3 or larger, provide your SSH public key for the azureuser account, and allow inbound ports 22, 80 and 443.
4. Review and create. The instance is ready once first boot completes (typically two to three minutes).

Step 2: Deploy from the Azure CLI

az vm create \
  --resource-group my-monitoring-rg \
  --name openitcockpit-ce \
  --image <offer-urn-from-listing> \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the web UI and SSH ports to your administrative network:

az vm open-port --resource-group my-monitoring-rg --name openitcockpit-ce --port 443 --priority 100
az vm open-port --resource-group my-monitoring-rg --name openitcockpit-ce --port 80 --priority 110

Step 3: Connect via SSH

ssh azureuser@<vm-public-ip>

Step 4: Verify the openITCOCKPIT Services

Confirm the core services are running. The Naemon engine, the mod-gearman check runner and the Statusengine worker are what actually execute your monitoring checks and record their results.

sudo systemctl is-active nginx php8.3-fpm mysql redis-server naemon statusengine mod-gearman-worker

Expected output:

active
active
active
active
active
active
active

The perfdata graphing subsystem and the report node run as Docker containers on the same host; you can list them with sudo docker ps.

Step 5: Retrieve the Per Instance Credentials

The admin login and database password are generated uniquely for this instance at first boot and written to a root only file. The admin username is an email address; the password is unique to this VM.

sudo cat /root/openitcockpit-ce-credentials.txt

The file lists the web UI URL, the admin user admin@cloudimg.local and its per instance password, the MySQL user and password, and the Grafana admin password. Keep it secure and change the admin password from the UI after your first login.

Step 6: Inspect the Network Exposure

Only nginx is exposed to the network, on ports 80 and 443. The MySQL database uses auth_socket for the root account, so no root database password ships in the image, and the monitoring engine, Redis and the graphing containers are all bound to loopback.

sudo ss -tlnp | grep -E ':80 |:443 '
sudo mysql --defaults-extra-file=/etc/mysql/debian.cnf -N -e "SELECT user, host, plugin FROM mysql.user WHERE user IN ('root','openitcockpit')"

Expected output:

LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",...))
LISTEN 0 511 0.0.0.0:80  0.0.0.0:* users:(("nginx",...))
openitcockpit   localhost   caching_sha2_password
root    localhost   auth_socket

Step 7: Confirm Live Monitoring

openITCOCKPIT ships monitoring itself out of the box. Confirm the Naemon engine is actively running checks and Statusengine has recorded their results, every service state should be 0 (OK).

sudo mysql --defaults-extra-file=/opt/openitc/etc/mysql/mysql.cnf \
  -e "SELECT current_state, LEFT(output,50) AS output FROM statusengine_servicestatus"

Expected output:

+---------------+----------------------------------------------------+
| current_state | output                                             |
+---------------+----------------------------------------------------+
|             0 | PING OK - Packet loss = 0%, RTA = 0.02 ms          |
|             0 | DISK OK - free space: / 5780MiB (20.2% inode=94%): |
|             0 | LOAD OK - total load average: 0.23, 0.16, 0.24     |
|             0 | Statusengine statistics                            |
+---------------+----------------------------------------------------+

Step 8: Open the Web UI and Log In

In a browser, open https://<vm-public-ip>/ (the image uses a self signed certificate, so accept the browser warning, or place your own certificate on nginx). Log in with the admin user admin@cloudimg.local and the password from /root/openitcockpit-ce-credentials.txt.

Step 9: Explore the Dashboard

After logging in you land on the dashboard. The Welcome widget confirms one host and four services are monitored on openITCOCKPIT 5.6.1, and the Hosts and Services pie charts show everything in the green OK state.

Step 10: View Monitored Hosts

Open Hosts from the Monitoring section of the navigation to see every monitored host, its current state, when it was last checked and its check output. The default host monitors the openITCOCKPIT server itself at 127.0.0.1.

Step 11: View Monitored Services

Open Services to see every monitored service and its live state. The four self monitoring services, Ping, disk usage, Linux load and Statusengine performance, are all OK, each with its real check output, last check time and next scheduled check.

Step 12: Add a Host to Monitor

To start monitoring your own infrastructure, use the web UI:

1. Go to Hosts and select Add host, or launch the Wizard from the navigation for a guided setup.
2. Enter the host name and IP address or DNS name, choose a host template (for example a generic host with a Ping check) and assign it to a container.
3. Save, then add services to the host from the service templates (HTTP, SSH, disk, load, and many more from the bundled monitoring plugins).
4. openITCOCKPIT writes the Naemon configuration and applies the changes; the new host and its services begin reporting within a couple of check intervals.

For agent based monitoring of Linux and Windows servers, install the openITCOCKPIT monitoring agent on the target and register it from the Agent configuration.

Step 13: Managing the Services

sudo systemctl restart nginx
sudo systemctl status naemon --no-pager
sudo docker ps

Naemon, Statusengine and mod-gearman are the monitoring pipeline; nginx and php8.3-fpm serve the UI; MySQL holds the configuration and monitoring data. The graphing containers are managed by openitcockpit-graphing.service.

Step 14: Security Recommendations

• Change the admin password from Profile after your first login, and create individual named user accounts rather than sharing the admin login.
• Restrict the network security group so that ports 80 and 443 are reachable only from your administrative network or a VPN, and SSH only from trusted addresses.
• Install a trusted TLS certificate on nginx in place of the self signed certificate, and consider redirecting all traffic to HTTPS only.
• Keep the system patched, unattended security upgrades remain enabled on the image.
• The per instance secrets in /root/openitcockpit-ce-credentials.txt are readable only by root; treat that file as sensitive.

Step 15: Support and Licensing

openITCOCKPIT Community Edition is licensed under the GNU General Public License version 3 and is a complete, functional monitoring platform. The optional Enterprise Edition adds ITSM integrations and distributed, highly available monitoring for large scale deployments; it is not required for the Community Edition to function. This image ships the Community Edition only.

Deploy on Azure

Find the openITCOCKPIT Community Edition on Ubuntu 24.04 listing on Azure Marketplace and select Get It Now.

Need Help?

cloudimg provides 24/7 support with a guaranteed 24 hour response SLA. Contact support@cloudimg.co.uk for deployment assistance, configuration guidance or licensing questions.