Tenzir on Ubuntu 24.04 on Azure User Guide

Overview

Tenzir is the open source (BSD 3 Clause) data pipeline engine for security teams. It collects, parses, normalises, enriches, reduces, stores and routes security telemetry such as logs and events, and lets you query it with TQL, a purpose built pipeline language that uses the same syntax for both live streaming and historical analysis. Each node ships a built in columnar edge storage engine, so you can import events into the node and query them back with no external database.

This cloudimg image installs the open source Tenzir node from the pinned upstream package. It is fully standalone: the open source edition contains no platform plugin, so the node needs no token, no subscription and no outbound connection to any management service. It is not the commercial Tenzir Platform (the paid web UI), which this image deliberately does not ship. Backed by 24/7 cloudimg support.

What is included:

• The open source Tenzir node (tenzir-node.service) and the tenzir command line client
• The node control endpoint bound to 127.0.0.1:5158 (loopback only, a binary protocol, no web UI)
• The built in columnar edge storage engine, reachable from TQL with the import and export operators
• A start time bind guard that refuses to run the node on any non loopback endpoint
• An nftables host firewall that default denies inbound traffic (only SSH is allowed)
• A one command self test at /opt/cloudimg/tenzir-roundtrip.sh
• 24/7 cloudimg support

This is a headless product: the node control endpoint listens on 127.0.0.1:5158 only and has no browser interface. You run TQL pipelines with the tenzir client on the VM. The columnar store ships empty.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region. Standard_B2s (2 vCPU, 4 GiB RAM) is a good starting point for evaluation and light pipelines; choose Standard_B2ms (8 GiB) or larger for heavier sustained ingestion. NSG inbound: allow 22/tcp from your management network only. No inbound application ports are needed because the node is loopback only.

Step 1: Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Tenzir by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) only. Then Review + create, then Create.

Step 2: Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name tenzir \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3: Connect to your VM

ssh azureuser@<vm-ip>

The Tenzir client lives in /opt/tenzir/bin, which is added to your PATH automatically for login shells. If you run commands in a non login shell, add it explicitly:

export PATH="$PATH:/opt/tenzir/bin"

Step 4: Confirm the node is running

export PATH="$PATH:/opt/tenzir/bin"
tenzir 'version'
systemctl is-active tenzir-node

You should see the Tenzir version (6.9.0) and active.

Step 5: Import events into the node store with TQL

Tenzir stores events in its built in columnar engine. The import operator writes the output of a pipeline into the store. Here we ingest a small set of example security events:

export PATH="$PATH:/opt/tenzir/bin"
tenzir 'from {event: "ssh_login", user: "alice", src_ip: "203.0.113.10", outcome: "success"}, {event: "ssh_login", user: "bob", src_ip: "198.51.100.7", outcome: "failure"}, {event: "ssh_login", user: "root", src_ip: "198.51.100.7", outcome: "failure"}, {event: "http_request", src_ip: "203.0.113.55", path: "/admin", status: 403} | import'

In production you would replace the inline from {...} source with a real input such as from_file, load_tcp, from_kafka, or one of the many built in connectors, and the rest of the pipeline stays the same.

Step 6: Query the store with TQL

The export operator reads events back from the store. Combine it with where, select and summarize to filter, project and aggregate. Tenzir pushes filters down into the storage engine for fast historical queries:

export PATH="$PATH:/opt/tenzir/bin"
tenzir 'export | where event == "ssh_login" and outcome == "failure" | select user, src_ip'
tenzir 'export | where outcome == "failure" | summarize src_ip, failures=count()'
tenzir 'export | summarize event, events=count()'

The first pipeline returns the failed SSH logins, the second aggregates failures by source IP, and the third counts every stored event by type.

Step 7: Run the built in self test

The image ships a one command end to end self test. It confirms the node is active and loopback bound, imports a set of events, queries them back, and fails loudly if the round trip returns nothing:

sudo /opt/cloudimg/tenzir-roundtrip.sh

It prints a round trip summary and TENZIR ROUND-TRIP OK on success.

Security model

The node control endpoint binds 127.0.0.1:5158 (loopback) only. The open source node has no built in authentication on this endpoint, so it must never be exposed off the VM. This image enforces that with three layers:

• A systemd drop in pins the endpoint to 127.0.0.1:5158, and a start time bind guard (/usr/local/sbin/tenzir-bindguard.sh) refuses to start the node on any non loopback or wildcard address.
• An nftables host firewall default denies inbound traffic, allowing only SSH (22/tcp), so every node port is unreachable off the VM regardless of your NSG.
• Keep your NSG limited to 22/tcp from trusted networks.

sudo ss -tlnp | grep tenzir-node
sudo nft list table inet cloudimg

The node listens on 127.0.0.1:5158; the internal actor port is bound to a random high port but is blocked off the VM by the host firewall.

Where things live

Managing the service

systemctl status tenzir-node
sudo systemctl restart tenzir-node
journalctl -u tenzir-node --no-pager | tail -20

Support

This image is maintained by cloudimg with 24/7 support. Tenzir is a trademark of Tenzir GmbH; this image packages the open source Tenzir node and is not affiliated with or endorsed by Tenzir GmbH. See the cloudimg guides for more.