Skip to content

Operations

How the instance is secured, how to manage the Collector, and how to back up, update and get help.

Security model

  • Loopback only. OTLP gRPC (4317), OTLP HTTP (4318), health (13133) and internal metrics (8888) listen on 127.0.0.1. Plain HTTP to port 4318 is refused.
  • Per-instance TLS. First boot creates the certificate and private key on the instance. They are not in the image.
  • File permissions. The private key is owned by root, group otelcol, mode 0640, in a directory the ubuntu user cannot open. Clients use the public copy at /usr/local/share/sushi/otelcol/cert.pem.
  • No client authentication. Any local process that trusts the certificate can send telemetry.
  • Dedicated user. The Collector runs as the otelcol system user and can write only to /var/lib/otelcol.
  • SSH. Password login and root login are disabled. Use Session Manager, or SSH with a key pair from your administrative network only.
  • No AWS permissions needed for the default pipelines.

Services

Unit What it does
sushi-otelcol-firstboot.service Creates the TLS material, directories and config. Runs before the Collector.
otelcol.service The Collector itself 
systemctl status otelcol
sudo systemctl restart otelcol

Health and metrics

curl http://127.0.0.1:13133/
curl -s http://127.0.0.1:8888/metrics | head

Logs

sudo journalctl -u otelcol -n 100 --no-pager

Backups

Back up /var/lib/otelcol/ and /etc/otelcol/ together. Stop the Collector first if you need a consistent copy of the JSON file:

sudo systemctl stop otelcol
sudo tar -czf /var/backups/otelcol-backup.tar.gz /var/lib/otelcol /etc/otelcol
sudo systemctl start otelcol

After you restore the certificate and key on a new instance, run first boot again so it republishes the public copy of the certificate:

sudo systemctl restart sushi-otelcol-firstboot
sudo systemctl restart otelcol

Updates

  • Ubuntu security updates install automatically through unattended upgrades.
  • The Collector stays on the version in the image. New versions ship as new image versions.

A new image version does not update a running instance. To move to it, launch the new version, copy the config, TLS files and output across, then point your clients at the new instance. Try the move on a test instance first.

Support

Software Sushi provides packaging and setup guidance for this image. Email info@softwaresushi.com with your instance ID and a description of the problem. Do not send private keys or telemetry that contains secrets. This offer does not include OpenTelemetry project support.