perfSONAR Toolkit on AlmaLinux 9 on Azure User Guide

Overview

This image ships the full perfSONAR Toolkit on AlmaLinux 9, configured and ready to use from the first boot of every deployed virtual machine. perfSONAR is the widely deployed open source toolkit for measuring and troubleshooting network performance, developed by ESnet, Internet2, GEANT and Indiana University. This appliance installs the complete perfsonar-toolkit bundle from perfSONAR's official, GPG-signed EL9 repository: the pScheduler measurement scheduler, the owamp and twamp one-way and two-way latency daemons, iperf3 and the throughput tools, round-trip and path measurement, the OpenSearch measurement archive, the Grafana dashboards, and the lookup-service registration daemon.

perfSONAR is licensed under the Apache License 2.0. This is the genuine upstream toolkit, unmodified except for cloudimg's secure-by-default first-boot provisioning.

The web interface is served over HTTPS on port 443 by Apache httpd. Navigating to the virtual machine's address lands you on the perfSONAR dashboard, a Grafana instance carrying the perfSONAR Main, perfSONAR Host Metrics and Endpoint Pair Explorer dashboards. The public dashboards are read-only and require no login; the Grafana administrator account and the Toolkit administration console are password protected.

Authentication is independent per virtual machine. The web front door stays closed until first boot completes, and on that first boot a one-time initialisation service mints a unique Grafana administrator password and a unique Toolkit administration password, regenerates every credential in the measurement archive, writes the web passwords to a single credentials file readable only by root, then permanently marks itself done. Two virtual machines launched from the same gallery image never share a password, and no default web login ever exists on a running instance. The OpenSearch measurement archive binds to localhost only.

AlmaLinux 9 is a free, community-led, binary-compatible rebuild of Red Hat Enterprise Linux 9. The image is intended for network engineers, research-and-education network operators, and infrastructure teams who want a production-grade perfSONAR measurement point ready in minutes. A single perfSONAR node measures against other perfSONAR nodes: to produce throughput and one-way latency results you point it at a remote perfSONAR host (a public one or another instance of this image). Section 8 covers configuring regular tests.

The brand is lowercase cloudimg throughout this guide. All cloudimg URLs use the form https://www.cloudimg.co.uk.

Prerequisites

Before you deploy this image you need:

• A Microsoft Azure subscription with permissions to create resource groups, virtual networks, and virtual machines
• An SSH public key for initial login to the azureuser admin account on the virtual machine
• A virtual network and subnet with an associated network security group
• Inbound NSG rules allowing TCP 22 from your management IP and TCP 443 from the IPs that need the perfSONAR dashboard
• For real measurements, TCP/UDP reachability to the perfSONAR hosts you intend to test against (Section 13 lists the ports)
• The Azure CLI (az version 2.50 or later) if you intend to use the CLI deployment path in Section 2

Step 1: Deploy the Virtual Machine from the Azure Portal

Navigate to Marketplace in the Azure Portal, search for perfSONAR Toolkit AlmaLinux, and select the cloudimg publisher entry. Click Create.

On the Basics tab choose your subscription, target resource group, and region. Set the virtual machine name. Choose SSH public key as the authentication type, set the username to azureuser, and paste your SSH public key. Standard_B2ms (2 vCPU, 8 GiB) is the recommended minimum size: the toolkit runs OpenSearch and Logstash (both JVM based) alongside Grafana and PostgreSQL, and 4 GiB is too tight. For a busy measurement point archiving many test partners, Standard_B4ms (4 vCPU, 16 GiB) or larger is a better starting point.

On the Disks tab select Standard SSD for the OS disk.

On the Networking tab select your existing virtual network and subnet. Attach a network security group that opens TCP 22 from your management IP range and TCP 443 from the client IPs that need dashboard access. To run measurements you must also open the measurement ports in Section 13 to and from your test partners.

On the Management, Monitoring, and Advanced tabs the defaults are appropriate. Click Review + create, wait for validation to pass, then click Create. Deployment takes around two to three minutes; the first boot then runs the credential-provisioning service, which takes a few minutes more before the dashboard becomes reachable.

Step 2: Deploy the Virtual Machine from the Azure CLI

To deploy from the command line, reference the gallery image resource identifier published on the Partner Center plan. A representative invocation:

RG="perfsonar-prod"
LOCATION="eastus"
VM_NAME="perfsonar-01"
ADMIN_USER="azureuser"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/perfsonar/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"

az group create --name "$RG" --location "$LOCATION"

az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2ms \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard

Open the required ports on the network security group afterwards with az network nsg rule create (TCP 22 and 443 at minimum).

Step 3: Connect over SSH

Log in to the administrative account with the SSH key you supplied at deployment:

ssh azureuser@<your-vm-public-ip>

The message of the day points you at the credentials file and this guide.

Step 4: Retrieve the First-Boot Credentials

On the first boot, the provisioning service writes a per-VM credentials file readable only by root. Retrieve it over SSH:

sudo cat /root/perfsonar-credentials.txt

The file contains the public dashboard URL, the Grafana administrator login, and the Toolkit administration console login. These values are unique to this virtual machine. The OpenSearch measurement archive is localhost-only and needs no customer action; its credentials are regenerated per VM automatically.

Step 5: Verify the Toolkit Is Running

perfSONAR is a collection of coordinated services. Confirm pScheduler is alive and the core daemons are active:

pscheduler ping localhost
systemctl is-active httpd opensearch pscheduler-scheduler owamp-server grafana-server

pScheduler is alive confirms the scheduler API is answering, and every listed unit reports active.

Step 6: Run Your First Measurement

pScheduler is the front end to every measurement. The simplest test is a round-trip-time (ping) measurement, which you can run against the loopback to confirm the measurement pipeline end to end:

pscheduler task rtt --dest 127.0.0.1 --count 3

To measure against a real remote perfSONAR host, replace the destination. A throughput test needs a perfSONAR host at the other end (throughput has two participants, so it cannot run against the loopback):

pscheduler task rtt --dest <remote-perfsonar-host>
pscheduler task throughput --dest <remote-perfsonar-host>
pscheduler task latency --dest <remote-perfsonar-host>

Public perfSONAR hosts published in the global lookup service are valid destinations, as is another virtual machine launched from this same image.

Step 7: The Web Dashboard

Open https://<your-vm-public-ip>/ in a browser. The virtual machine root redirects into the perfSONAR dashboard. The dashboards are served by Grafana; the public views are read-only and need no login.

The Grafana administrator login (for editing dashboards and data sources) is in the credentials file from Step 4:

The perfSONAR Host Metrics dashboard shows live host and service health immediately, including the service up/down history, the current status of every perfSONAR component, and the installed bundle and version:

The perfSONAR Main dashboard is where measurement results appear once regular tests are configured. On a freshly launched node with no test partners yet, the test panels read No data — this is expected. Configure regular tests (Section 8) and the panels populate:

Step 8: Configure Regular Tests and Test Partners

Ad-hoc pscheduler task runs are one-off. To build a continuous record that fills the dashboards, define regular tests with pSConfig or through the Toolkit administration console. A regular test is a schedule (for example, RTT every minute and throughput every hour) between this host and one or more remote perfSONAR hosts.

The Toolkit administration console at https://<your-vm-public-ip>/toolkit/ is the browser path: sign in with the toolkit_admin credentials from Step 4, then use the Configuration menu to add test partners and schedules. Alternatively, use psconfig on the command line to apply a JSON test template. Give each test a remote perfSONAR host as the partner; results flow into the local archive and appear on the perfSONAR Main dashboard.

Step 9: The Measurement Archive

Measurement results are stored in a local OpenSearch archive that binds to 127.0.0.1 only and is fronted by Grafana, so you never expose it directly. The archive credentials are regenerated uniquely on each virtual machine's first boot and require no manual handling. Grafana reads the archive through an authenticated reverse proxy; the dashboards you saw in Step 7 are backed by it.

Step 10: Toolkit Administration Console

The Toolkit administration console (/toolkit/) is password protected by a per-VM account created on first boot. Use the toolkit_admin.user and toolkit_admin.password values from the credentials file. From here you can set host administrative information, manage regular tests, adjust pScheduler limits, and review logs.

Step 11: Version and Health

Confirm the installed toolkit version, its licence, and the web health endpoint:

rpm -q perfsonar-toolkit perfsonar-core
rpm -qi perfsonar-core | grep License
curl -sk https://localhost/grafana/api/health

Step 12: Keeping the System Updated

The image ships fully patched. AlmaLinux security updates are applied with dnf:

sudo dnf -y upgrade --refresh

perfSONAR itself updates from its official repository as new toolkit releases land:

sudo dnf -y upgrade 'perfsonar-*'

Step 13: Network Ports

perfSONAR's measurement daemons require specific ports open to and from your test partners. The image's firewall (configured by perfsonar-toolkit-security) already opens them locally; you must mirror the equivalents on your Azure network security group for the partners you test against:

• TCP 22 — SSH administration
• TCP 443 — the perfSONAR dashboard and Toolkit console (HTTPS)
• TCP/UDP 861 — owamp control and one-way latency
• TCP/UDP 862 — twamp control and two-way latency
• TCP/UDP 5201, 5001, 5101, and the 8760-9960 range — throughput tools (iperf3, nuttcp) and owamp/twamp test ports

Restrict each rule to the specific partner hosts and management IPs; do not open the dashboard to the entire public internet.

Step 14: Security Hardening for Production

• Restrict the dashboard. Keep TCP 443 open only to the client IPs that need it. The public dashboard views are read-only, but there is no reason to expose them broadly.
• Rotate the web passwords if desired. The first-boot passwords are unique per VM. You can change the Grafana administrator password in the Grafana UI, and manage the Toolkit administration account with the perfSONAR manage_users tooling.
• Use a real certificate. The image serves HTTPS with a self-signed certificate. For a named host, install a CA-issued certificate into Apache's TLS configuration.
• Scope your measurement ports. Open owamp/twamp/throughput ports only to your intended perfSONAR partners, never to 0.0.0.0/0.
• Keep the system patched. Apply AlmaLinux and perfSONAR updates on a schedule (Step 12).

Support

Every cloudimg deployment is backed by 24/7 support. For help with this image, contact support@cloudimg.co.uk or visit https://www.cloudimg.co.uk. For perfSONAR itself, the upstream documentation at https://docs.perfsonar.net is the authoritative reference for measurement configuration and the wider perfSONAR mesh.