Skip to content

Operations

How the instance is secured, how to manage Fluent Bit, how to watch disk use, and how to back up, update and get help.

Security model

  • Loopback only. Ingest listens on 127.0.0.1:9880 (HTTPS) and the monitoring API on 127.0.0.1:2020 (HTTP). Plain HTTP to the ingest port is refused.
  • Per-instance TLS. First boot creates the certificate and private key on the instance. They are not in the image.
  • File permissions. The private key is owned by root, group fluent-bit, mode 0640, in directories the ubuntu user cannot open. Clients use the public copy at /usr/local/share/sushi/fluent-bit/cert.pem.
  • Dedicated user. Fluent Bit runs as the fluent-bit system user and can write only to /var/lib/fluent-bit.
  • SSH. Password login and root login are disabled. Use Session Manager, or SSH with a key pair from your administrative network only.
  • No AWS permissions needed for the default pipeline. Attach an IAM role only when you add an AWS output, scoped to that output's resources.

Services

Unit What it does
sushi-fluent-bit-firstboot.service Creates the TLS material, directories and config. Runs before Fluent Bit.
fluent-bit.service Fluent Bit itself 
systemctl status fluent-bit
sudo systemctl restart fluent-bit

Health and monitoring

curl --cacert /usr/local/share/sushi/fluent-bit/cert.pem https://127.0.0.1:9880/health
curl http://127.0.0.1:2020/api/v1/uptime

Logs

sudo journalctl -u fluent-bit -n 100 --no-pager

Disk use

The local destination grows without limit

accepted.log grows as records are delivered. The image does not rotate or delete it. Watch free disk space and set your own retention before you send a steady stream of logs.

df -h /
sudo du -sh /var/lib/fluent-bit/*

Delivery is not guaranteed to be lossless. When an output's queue reaches its limit, older chunks can be dropped, and records are dropped after five failed retries.

Backups

Back up /var/lib/fluent-bit/ and /etc/fluent-bit/ together. Stop Fluent Bit first if you need a consistent copy of in-flight chunks:

sudo systemctl stop fluent-bit
sudo tar -czf /var/backups/fluent-bit-backup.tar.gz /var/lib/fluent-bit /etc/fluent-bit
sudo systemctl start fluent-bit

Updates

  • Ubuntu security updates install automatically through unattended upgrades.
  • Fluent Bit stays on the version in the image. New versions ship as new image versions.

A new image version does not update a running instance. To move to it, launch the new version, copy the config, TLS files, buffer and local destination across, then point your clients at the new instance. Try the move on a test instance first.

Support

Software Sushi provides packaging and setup guidance for this image. Email info@softwaresushi.com with your instance ID and a description of the problem. Do not send private keys or log data that contains secrets. This offer does not include Fluent Bit project support.